Dump endpoint certificate to a PEM file

openssl \
    s_client \
    -showcerts \
    -connect HOST:PORT \
    </dev/null \
    2>/dev/null \
    | openssl x509 \
        -outform PEM