Lars Ingebrigtsen <larsi@gnus.org> writes:

> There's gnutls-peer-status, and that could also be amended to return the
> full certificate.  But, again, that's also called for virtually any TLS
> connection.

This has been added now in conjunction with the more extensive NSM
checks.  gnutls-peer-status now returns the entire certificate in Emacs
27.