Always check return from tls_export_cert()