Download TLS certificate from server

crt-load.sh

#!/bin/sh

#================== Load certificate from server ===============================

HOST_NAME="${HOST_NAME:-google.com}"
SERVER_NAME="${SERVER_NAME:-${HOST_NAME}}"
PORT="${PORT:-443}"
FORMAT="${FORMAT:-PEM}" # DER|PEM|NET see `man x509`
FILE_NAME="${FILE_NAME}" # Filename into /usr/local/share/ca-certificates

CERT=$(openssl s_client \
                 -showcerts \
                 -connect "${HOST_NAME}:${PORT}" \
                 -servername "$SERVER_NAME" \
                 </dev/null 2>/dev/null \
         | openssl x509 \
                 -outform ${FORMAT})
if [ $? -ne 0 ]; then exit 2; fi

#================== Print certificate to stdout and to file if need ============

if [ -n "$FILE_NAME" ]; then
  FILE_NAME=/usr/local/share/ca-certificates/$FILE_NAME
else
  FILE_NAME=""
fi

echo "$CERT" | tee $FILE_NAME

Thanks, this helped me debug some issues with my TLS client. You could also pipe the result into openssl req -text -noout -in - to print the certificate's metadata instead of its body.