I’ve known about
$ openssl s_client -connect github.com:443 -showcerts > github.com.crt
for a while, but was always annoyed about having to wait for the connection to timeout and close. Found a cool workaround here:
$ echo | openssl s_client -connect github.com:443 2>&1 | sed --quiet '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > github.com.crt
Note: the long form --quiet option infers gnu sed; if you’re on os x, you can
$ brew install --with-default-names gnu-sed