TLS certificate at endpoint

Fetch the leaf certificate via TLS; optional excerpt from openssl s_client -showcerts when available.