title: Using openssl to get the certificate from a server
body: <p>I am trying to get the certificate of a remote server, which I can then use to add to my keystore and use within my Java application.</p>
  <p>A senior dev (who is on holidays :( ) informed me I can run this:</p>
  <pre><code>openssl s_client -connect host.host:9999
  </code></pre>
  <p>to get a raw certificate dumped out, which I can then copy and export. I receive the following output:</p>
  <pre><code>depth=1 /C=NZ/ST=Test State or Province/O=Organization Name/OU=Organizational Unit Name/CN=Test CA
  verify error:num=19:self signed certificate in certificate chain
  verify return:0
  23177:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
  23177:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:
  </code></pre>
  <p>I have also tried it with this option:</p>
  <pre><code>-showcerts
  </code></pre>
  <p>and this one (running on Debian mind you):</p>
  <pre><code>-CApath /etc/ssl/certs/
  </code></pre>
  <p>But I get the same error.</p>
  <p><a href="http://gagravarr.org/writing/openssl-certs/personal.shtml" rel="noreferrer">This source</a> says I can use that CApath flag but it doesn't seem to help. I tried multiple paths to no avail.</p>
  <p>Please let me know where I'm going wrong.</p>