!! Overview
You can obtain a [Certificate] using [LDAP] by providing the hostname and port for the service using the [openSSL] client or using [LDAP].

[{TableOfContents}]

!! Using [openSSL]
As an  [Example] to get the [certificate] and the [Certificate Chain]
%%prettify 
{{{
openssl s_client -showcerts -connect ldap.yourdomain.com:636

CONNECTED(00000003)
depth=1 /CN=willeke.com
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/O=WILLEKETREE/CN=sa.willeke.com
   i:/CN=willeke.com
-----BEGIN CERTIFICATE-----
MIIFLDCCBBSgAwIBAgIkAhwR/6TVLmdRY6hHxvUFWc0+Enmu/Hu6cj+G2FIdAgID
aFXCMA0GCSqGSIb3DQEBBQUAMBYxFDASBgNVBAMMC3dpbGxla2UuY29tMB4XDTA5
MDgwNTE5MTMwMFoXDTM2MDIwMzIzNTgwMFowLzEUMBIGA1UEChMLV0lMTEVLRVRS
RUUxFzAVBgNVBAMTDnNhLndpbGxla2UuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAxZDnmHNZdonG99AIp8Wcrc1Scxl8DLFjGfaUjGBR8pO+7+HF
uB26kgjVkmLt2/J3bMbpka/p1ka9yvJqUSR9Su1To1ADrhWvodmZ1nyCfqqovUiw
MNZw1QsvXbJDEj66kdfEkoP5eI/B8B3voOVbaBCfPoxL0ilsG0dvq9Rz+dd7/qtH
5rYPkhhMij+3HwZnYvDGM4auUq+MT9BTO0GD2ga3AwC56hAG+tz6JL0RMD4qp3Sx
O0P0lATFOhfkhn9yFNeNC35TtpnyXe0oYIlLnV49BQwe2e8sRTdnr9IX44PEZa79
ONydv+pcUFpNvR1klLp/NlkDuewUa4cEtuE88QIDAQABo4ICRzCCAkMwHQYDVR0O
BBYEFJDDyRT3FBPTsb23TorF8tSRioBvMB8GA1UdIwQYMBaAFFxQC2nmUVScjATx
WWNKCm7sJTk9MA8GA1UdEQQIMAaHBMCoAQgwCwYDVR0PBAQDAgWgMIIBzAYLYIZI
AYb4NwEJBAEEggG7MIIBtwQCAQABAf8THU5vdmVsbCBTZWN1cml0eSBBdHRyaWJ1
dGUodG0pFkNodHRwOi8vZGV2ZWxvcGVyLm5vdmVsbC5jb20vcmVwb3NpdG9yeS9h
dHRyaWJ1dGVzL2NlcnRhdHRyc192MTAuaHRtMIIBSKAaAQEAMAgwBgIBAQIBRjAI
MAYCAQECAQoCAWmhGgEBADAIMAYCAQECAQAwCDAGAgEBAgEAAgEAogYCARcBAf+j
ggEEoFgCAQICAgD/AgEAAw0AgAAAAAAAAAAAAAAAAwkAgAAAAAAAAAAwGDAQAgEA
Agh//////////wEBAAIEBvDfSDAYMBACAQACCH//////////AQEAAgQG8N9IoVgC
AQICAgD/AgEAAw0AQAAAAAAAAAAAAAAAAwkAQAAAAAAAAAAwGDAQAgEAAgh/////
/////wEBAAIEEf+k1TAYMBACAQACCH//////////AQEAAgQR/6TVok4wTAIBAgIB
AAICAP8DDQCAAAAAAAAAAAAAAAADCQCAAAAAAAAAADASMBACAQACCH//////////
AQEAMBIwEAIBAAIIf/////////8BAQAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJ
KoZIhvcNAQEFBQADggEBAHyT3ibpKm9RjhME65E6gy+ihP0WjBd7sRzqXaTpk3qi
sZpoZOHhp1risw0HEDrEhFn0oB3Ri4aRudgt7gW+g13mFfIrERC/g17zf6O8XhyY
oPPJA+lHqh438MaHYbh08h/WyO0drvjmApxH+ILgP2FZXoOH0XyxhXcji5Kp3eee
uat9KUY/PslZI/VK8smO9lQWEQZVQAZeEQby9Z/g/qD6pgjsqWQgmoyXHX549mpV
oHPlEieOCQN1Wohd7gyempBjlIDl5X/lqo0/jx4P4cSFC7McIofn4KhVaTmrs0W6
BjfyI9d8xdBxn35b/cVTieyHnWHmU7ClB/IDh8DeraM=
-----END CERTIFICATE-----
 1 s:/CN=willeke.com
   i:/CN=willeke.com
-----BEGIN CERTIFICATE-----
MIIE+zCCA+OgAwIBAgIkAhwR/6TVLmdRY6hHxvUFWc0+Enmu/Hu6cj+G2FIdAgIC
IS07MA0GCSqGSIb3DQEBBQUAMBYxFDASBgNVBAMMC3dpbGxla2UuY29tMB4XDTA5
MDIxODE1MjYwMFoXDTM2MDIwMzIzNTkwMFowFjEUMBIGA1UEAwwLd2lsbGVrZS5j
b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC61KKmihkXMIuO02GW
pZnXd7fpc3gc8hfX2qQPU//+9sllT3G2R/gUPxTc7Yv6Wvfl4wgZe7E/QEe6r4yf
IWRLGly+OTHhMiJll7jhElez8HiGo5uzGD31M830yBiBDaVsNcc9EIPFC8kznVCV
oeG6p9PmBuBAGsaHalQPemvM0A5aYeddMKP3weLCY2iakxmm+gCKcPTEMDo6EZQe
dOMXJSanhr/qN5BEqFhfJIDe6T6R1rwp6BvE9CztSCsqXW5Z3SDO+EAFmjYrdOjx
gEY4qMrCxDlO/0dNjS9ShHcihjdhirQshYyXhdPwd4pYbzv9sejlkkvPsV+RQKAC
eJ6dAgMBAAGjggIvMIICKzAdBgNVHQ4EFgQUXFALaeZRVJyMBPFZY0oKbuwlOT0w
HwYDVR0jBBgwFoAUXFALaeZRVJyMBPFZY0oKbuwlOT0wDAYDVR0TBAUwAwEB/zAL
BgNVHQ8EBAMCAQYwggHMBgtghkgBhvg3AQkEAQSCAbswggG3BAIBAAEB/xMdTm92
ZWxsIFNlY3VyaXR5IEF0dHJpYnV0ZSh0bSkWQ2h0dHA6Ly9kZXZlbG9wZXIubm92
ZWxsLmNvbS9yZXBvc2l0b3J5L2F0dHJpYnV0ZXMvY2VydGF0dHJzX3YxMC5odG0w
ggFIoBoBAQAwCDAGAgEBAgFGMAgwBgIBAQIBCgIBaaEaAQEAMAgwBgIBAQIBADAI
MAYCAQECAQACAQCiBgIBGAEB/6OCAQSgWAIBAgICAP8CAQADDQCAAAAAAAAAAAAA
AAADCQCAAAAAAAAAADAYMBACAQACCH//////////AQEAAgQG8N9IMBgwEAIBAAII
f/////////8BAQACBAbw30ihWAIBAgICAP8CAQADDQBAAAAAAAAAAAAAAAADCQBA
AAAAAAAAADAYMBACAQACCH//////////AQEAAgQR/6TVMBgwEAIBAAIIf///////
//8BAQACBBH/pNWiTjBMAgECAgIA/wIBAAMNAID//////////////wMJAID/////
////MBIwEAIBAAIIf/////////8BAf8wEjAQAgEAAgh//////////wEB/zANBgkq
hkiG9w0BAQUFAAOCAQEAHGLjz3FMOsQF1BpdSFv+RB678QWXUjasvypoY1MOXQPM
t12xLlZ/trRmGcZUO8q/UP64Pk+UgeFUKjcBtj+H7PJcjTj4LNO8Qv9iTPlnm1/T
JI+vdpc5eSUpI9J+4QYvMoUEVARtZ57vebPOLkJcT94kRyMVyE+jgU7ULnhLSL3X
n7gYzS5N5ZbmggVV0pEtcpXJTBolDnmA5l6NosVIOM7X/sgSa3cIFNrRsv/+Tkxj
ff0lJoiFZS0t40iwvyD6ncViapSrt/2Nhd08hGDZ/ASa6/YkGvkfPTRv2waKPHD6
l6otw814+oxbN3kqi9KadwfauSa2gKLp4yanHjLi5A==
-----END CERTIFICATE-----
---
Server certificate
subject=/O=WILLEKETREE/CN=sa.willeke.com
issuer=/CN=willeke.com
---
No client certificate CA names sent
---
SSL handshake has read 2772 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: D3D1910519267B6C0C85510E6729BFD6FD42323A63B4F224BB1F1F860D2E9EFB
    Session-ID-ctx: 
    Master-Key: EC74C6B5E3016BD901524A4D5569F9EA0A2B10C4DB687EBC8CC9628D8293AC46108C8985B2760A09A85B1CA719A2A8B4
    Key-Arg   : None
    Start Time: 1352639875
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

0$x
?1.3.6.1.4.1.1466.20036closed
}}} /%

To obtain the certificate from site:
%%prettify 
{{{
openssl s_client -showcerts -connect mail.google.com:443 -servername mail.google.com </dev/null 2>/dev/null >mail.google.com.cert
}}} /%

To obtain only from the -BEGIN CERTIFICATE- to and -END CERTIFICATE- of part of the certificate as needed for many purposes:
%%prettify 
{{{
openssl s_client -showcerts -connect mail.google.com:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem
}}} /%


!! Using [ldapsearch command utility] 
We do a lot of automation of installation and maintenance using scripts and tricks.

We often use [ldapsearch command utility] on Linux and OS X machines.

The process we show here only works with [EDirectory], but it maybe able to be used on other [LDAP Server Implementations] with slight modifications.

The process would be similar to:
* User [ldapsearch command utility] to export the binary [certificate] to a file.
* Convert the binary [certificate], if required, to [PEM] format

For using [ldapsearch command utility]:
{{{
ldapsearch -x -T ~/ -t -h your-edirectory-host.yourdomain.com -b "cn=Security" objectclass=nDSPKICertificateAuthority cACertificate
}}}

This will create file in the home directory of the user similar to:
{{{
ldapsearch-cACertificate-FS7uCC
}}}

You can then run this [OpenSSL] command to convert to [PEM] ([base64]) format:
{{{
openssl x509 -inform der -in ~/ldapsearch-cACertificate-FS7uCC -out ~/trustedroot.pem
}}}
The resulting trustedroot.pem file will be a txt file you can use.

!! Using [modified InstallCert|http://s-n-ushakov.blogspot.com/2013/11/yet-another-installcert-for-java-now.html|target='_blank'] (a Java program)

{{{
java -jar installcert-usn-20131123.jar your-host.yourdomain:port
}}}

The modified program is capable of obtaining SSL/TLS certificates from LDAP/STARTTLS servers as well as from ordinary LDAPS servers. It will display information on every obtained certificate and ask whether you would like to save them. The certificates are saved in [Java KeyStore] ([JKS]) format in the {{jssecacerts}} file in your JRE file tree, and also in the {{extracerts}} file in your current directory. You can then use [Java keytool|http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html|target='_blank'] to export the certificate(s) to other formats.

!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]