With apis such as the following:
int s2n_config_add_cert_chain_and_key(struct s2n_config *config,
char *cert_chain_pem,
char *private_key_pem);

could you add const to the char * parameters if they are in fact read-only? That will clarify the ownership of the memory, and make it easier to optimize.