Techpository

openssl s_client -connect dc.domainname.com:636 -CApath /etc/pki/ca-trust/source/anchors -cert /etc/pki/tls/certs/servercertificatename.cer

openssl verify yourcert.cer

openssl x509 -text -noout -in certificate.crt

The p7b file contains the main domain cer, issuer server cert, and the cert for the server that requested the new cert.

openssl pkcs7 -inform DER -print_certs -in | awk ‘split_after==1{n++;split_after=0} /—–END CERTIFICATE—–/ {split_after=1} {print > “cert” n “.pem”}’

cp cert into /etc/pki/ca-trust/source/anchors/

Run the following comman:
update-ca-trust extract