draft-lozano-tmch-func-spec-07.txt
5.1.1.3. TMCH Trust Anchor
Each Registry Operator MUST fetch the X.509 certificate ([RFC5280] /
[RFC6818]) of the ICANN-CA (Trust Anchor) from
< https://ca.icann.org/tmch.crt > to be used:
--> stored in icann/tmch.crt
openssl x509 -in tmch.crt -out tmch.der -outform DER
openssl x509 -in tmch.der -inform DER -out tmch.pem -outform PEM