Mention how to download certificates using openssl s_client in X.509.

diff --git a/posts/X.509_certificates.mdwn b/posts/X.509_certificates.mdwn
index 9ef76b2936d68858a50a69f1f8b9358e1b363892..0516209a500417b79a5fd3bc1e90fe632fad1470 100644 (file)
--- a/posts/X.509_certificates.mdwn
+++ b/posts/X.509_certificates.mdwn
@@ -101,6 +101,16 @@ between `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`.
 The `.crt` files requested by `update-ca-certificates` (discussed
 below) are generally binary DER files, but can also be base64 encoded.
 
+Downloading certificates
+========================
+
+You can download certificates from remote servers using [[OpenSSL's
+simple client|Simple_servers]]:
+
+    $ openssl s_client -showcerts -connect host:port
+
+The PEM certificates will be printed to your terminal.
+
 System wide certificates
 ========================