fetch
Opens an ephemeral TLS connection to host:port, performs OS-level certificate chain validation and RFC 2818/6125 hostname verification (the presented certificate must actually match host, not merely be CA-valid), and returns the server's leaf certificate as a PEM string.
The returned PEM string can be passed directly to verify.
Return
PEM-encoded leaf certificate string
Parameters
Hostname to connect to (e.g. "api.example.com")
TCP port — defaults to 443
End-to-end deadline in milliseconds. Default 30s. Clamped to [MIN_OPERATION_TIMEOUT_MS, MAX_OPERATION_TIMEOUT_MS] (currently 10s–120s) to bound both pathologically short timeouts that race with TLS handshakes and unbounded blocking.
Throws
if the TLS handshake fails or no leaf certificate is present
if the supplied timeout elapses before completion