function certfor() {
  if [ "x$1" = "x" ] ; then
    echo 'abort: specify host:port pair as argument'
    return 1
  fi
  openssl x509 -in <(echo | openssl s_client -showcerts -connect $1 | \
    awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/') -noout -text
}