#!/bin/bash

if [ -z "$1" ] ; then
    echo usage: $0 URL-TO-PEM
    exit 1
fi

pkfil=$(mktemp)
trap "[ -f \"$pkfil\" ] && rm -f \"$pkfil\"" EXIT

curl "$1" |
  openssl x509 -inform PEM -noout -pubkey > "$pkfil" || { echo "failed to download" ; exit 1 ; }

{ openssl rsa -in "$pkfil" -pubin -outform DER || openssl ec -pubin -in "$pkfil" -outform DER ; } |
  openssl dgst -sha256 -hex |
  awk '{print "le-ca TLSA 2 1 1", $NF}'