grab a server's public SSL certificate and save it to disk

#!/bin/bash

if [[ -z $1 ]]; then
    echo "Need a hostname."
    exit 1
fi

AWK=$( which gawk )
if [[ $? -ne 0 ]]; then
    AWK=$( which awk )
fi

WORKDIR=$( mktemp -d -t get_cert )
abort() {
    EC=$?
    rm -rf $WORKDIR
    echo "Exiting: $EC"
}

HDIR="$(pwd)"

PORT="$( echo "$1" | cut -d ":" -f 2 )"
if [[ -z $PORT ]]; then
    echo "No port specified."
    exit 1
else
    SERVICE="$( grep -E "\b$PORT\b" /etc/services | awk '{print $1}' | head -n1 )"
    if [[ -z $SERVICE ]]; then
        SERVICE=$PORT
    fi
fi

HOST="$1"

shift
if [[ -n $1 ]]; then
    EXTRA=$@
else
    EXTRA=""
fi


pushd $WORKDIR > /dev/null 2>&1
echo "QUIT" | openssl s_client -showcerts $EXTRA -connect ${HOST} 2>&1 | $AWK 'split_after == 1 {n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "excert" n }'

for certfile in $( grep -l "BEGIN CERTIFICATE" excert* ); do
    NEWCERT=${certfile}.crt
    cat $certfile | openssl x509 > $NEWCERT
    SUBJECT=$( cat $NEWCERT | openssl x509 -noout -subject | grep -Eo "CN=.*" | cut -d "=" -f 2- | sed -e 's/[^a-zA-Z0-9_\.-]/_/g' )
    LOOP=0
    APPEND=""
    while [[ 1 -eq 1 ]]; do
        NEWNAME="${SUBJECT}_${SERVICE}${APPEND}.crt"
        if [[ -f "$HDIR/$NEWNAME" ]]; then
            LOOP=$(( $LOOP + 1 ))
            APPEND="_$LOOP"
        else
            break
        fi
    done
    mv $NEWCERT "$HDIR/$NEWNAME"
    rm -f $certfile
    echo "${NEWNAME} created."
done
popd  > /dev/null