def get_certificate_via_tls(host, port, timeout=10):
    """
    Makes a TLS network connection to retrieve the current certificate for the specified host and port.

    Note that if the host is valid but the port is not, we'll wait for the timeout for the connection to fail,
    so this should remain low when doing bulk operations.

    :param host: Host to get certificate for
    :param port: Port to get certificate for
    :param timeout: Timeout in seconds
    """
    context = ssl.create_default_context()
    context.check_hostname = False  # we don't care about validating the cert
    context.verify_mode = ssl.CERT_NONE  # we don't care about validating the cert; it may be self-signed
    conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    conn.settimeout(timeout)
    conn.connect((host, port))
    sock = context.wrap_socket(conn, server_hostname=host)
    sock.settimeout(timeout)
    try:
        der_cert = sock.getpeercert(True)
    finally:
        sock.close()
    return ssl.DER_cert_to_PEM_cert(der_cert)

    Makes a TLS network connection to retrieve the current certificate for the specified host and port.

    Note that if the host is valid but the port is not, we'll wait for the timeout for the connection to fail,
    so this should remain low when doing bulk operations.

    :param host: Host to get certificate for
    :param port: Port to get certificate for
    :param timeout: Timeout in seconds
    
lemur/common/utils.py