Root cert fingerprint = A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B Root cert fingerprint = 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33
savannah.gnu.org:
MD5 fingerprint:
b5d537d80b2317887116ff91b0ecdccb
SHA-1 fingerprint:
22e8ba8d6cf8b1f0f5c893d0977a0fa055b0051d
Public Key Id:
060f248fbf01ece87c23658235c798d95fc211e7
savannah.nongnu.org:
MD5 fingerprint:
7bde181919c336af2d8e2b7343743e63
SHA-1 fingerprint:
423fd06b6ae9c021880c3cdf9aedcfee540ff32f
Public Key Id:
528b42b7faf5922388c2c470a3a8e635d4325a1e

Get GnuTLS and its
certtool utility [doc].
(Debian package: gnutls-bin, Fedora package: gnutls-utils):
$ certtool --certificate-info --infile savannah.gnu.org.pem
[...]
Other information:
MD5 Fingerprint: XX:XX:XX:...
[...]
# shorter version: certtool -i < savannah.gnu.org.pem
We'll use gnutls-cli [doc]:
$ gnutls-cli --x509cafile /usr/share/ca-certificates/cacert.org/cacert.org.crt savannah.gnu.org Processed 2 CA certificate(s). Resolving 'savannah.gnu.org'... Connecting to '199.232.41.3:443'... - Ephemeral Diffie-Hellman parameters - Using prime: 1024 bits - Secret key: 1021 bits - Peer's public key: 1024 bits - Certificate type: X.509 - Got a certificate list of 1 certificates. - Certificate[0] info: - subject `CN=savannah.gnu.org', issuer `O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org', RSA key 2048 bits, signed using RSA-SHA, activated `2009-08-25 10:55:26 UTC', expires `2010-02-21 10:55:26 UTC', SHA-1 fingerprint `8dbc5960da8365c1bd2803d2fe0a298db6af853f' <-- verify the fingerprint - The hostname in the certificate matches 'savannah.gnu.org'. - Peer's certificate is trusted <-- check this line - Version: TLS1.0 - Key Exchange: DHE-RSA - Cipher: AES-128-CBC - MAC: SHA1 - Compression: NULL - Handshake was completed - Simple Client Mode: [...]
$ gnutls-cli --print-cert savannah.gnu.org </dev/null >sv.pem
You then can display the certificate as usual:
$ certtool -i < sv.pem
$ cat sv.pem /usr/share/ca-certificates/cacert.org/cacert.org.crt | certtool -e Certificate[0]: CN=savannah.gnu.org Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Verifying against certificate[1]. Verification output: Verified. Certificate[1]: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Verifying against certificate[2]. Error: Issuer's name: O=CAcert Inc.,OU=http://www.CAcert.org,CN=CAcert Class 3 Root certtool: Issuer's name does not match the next certificateThe first paragraph indicates that the key does validate against CAcert's root certificate. The second one show a slight inconsistency in the CAcert canonical name.
Check this blog post from GnuTLS' maintainer.