private List<SignedCertificateTimestamp> getSCTsFromOCSPResponse(
            byte[] data, OpenSSLX509Certificate[] chain) {
        if (data == null || chain.length < 2) {
            return Collections.emptyList();
        }

        byte[] extData = NativeCrypto.get_ocsp_single_extension(data, Constants.OCSP_SCT_LIST_OID,
                chain[0].getContext(), chain[0], chain[1].getContext(), chain[1]);
        if (extData == null) {
            return Collections.emptyList();
        }

        try {
            return getSCTsFromSCTList(
                    Serialization.readDEROctetString(Serialization.readDEROctetString(extData)),
                    SignedCertificateTimestamp.Origin.OCSP_RESPONSE);
        } catch (SerializationException e) {
            return Collections.emptyList();
        }
    }
Extract a list of SignedCertificateTimestamp contained in an OCSP response.
If the data is null, or parsing the OCSP response fails, an empty list is returned.
Individual SCTs which fail to be parsed are skipped.
@param data contents of the OCSP response
@param chain certificate chain for which to get SCTs. Must contain at least the leaf and it's
             issuer in order to identify the relevant SingleResponse from the OCSP response,
             or an empty list is returned
common/src/main/java/org/conscrypt/ct/Verifier.java