This is a note to myself because I don’t do this often enough to remember the whole thing…
openssl s_client -showcerts -connect hoge.com:443 < /dev/null | openssl x509 -outform DER > hoge.com.cer
You obviously have to have openssl on your machine. Install Cygwin if you are on Windows and that will give you an ability to execute openssl.