draft-lozano-tmch-func-spec-07.txt

   5.1.1.3.  TMCH Trust Anchor
   Each Registry Operator MUST fetch the X.509 certificate ([RFC5280] /
   [RFC6818]) of the ICANN-CA (Trust Anchor) from
   < https://ca.icann.org/tmch.crt > to be used:

  --> stored in icann/tmch.crt

openssl x509 -in tmch.crt -out tmch.der -outform DER
openssl x509 -in tmch.der -inform DER -out tmch.pem -outform PEM