Quick command to get the base-64 encoded certificate — useful for establishing trust with AD DS domain controllers

openssl s_client -connect dc5.example.com:636 -showcerts </dev/null 2>/dev/null | awk ‘BEGIN{c=0} /BEGIN CERTIFICATE/{c++} c==1{print} /END CERTIFICATE/ && c==1{exit}’