``` `openssl s_client -connect hostname:443 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM > server-cert.pem` ``` `-showcerts` - shows all certificates in the chain `</dev/null` - prevents openssl from waiting for input `2>/dev/null` - hides the verbose output The output is piped to `openssl x509 -outform PEM` which extracts the first certificate in PEM format.