T:\>openssl s_client -servername gwendragon.de -connect gwendragon.de:443 | openssl x509 -text -noout
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify error:num=20:unable to get local issuer certificate
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:e4:c4:2f:63:11:93:2f:b2:a5:d9:58:8c:44:83:a4:d2:70
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
        Validity
            Not Before: May 18 08:30:02 2018 GMT
            Not After : Aug 16 08:30:02 2018 GMT
        Subject: CN=gwendragon.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:9d:07:5f:b6:ac:b5:34:d2:1b:63:b4:f2:7b:da:
                    d5:62:7b:28:24:7a:77:79:53:4a:e6:8c:96:b4:d5:
                    66:17:c3:5d:95:b1:5e:6c:d4:86:a2:13:cf:5b:a0:
                    71:ae:b0:1e:ae:fd:61:b9:92:da:b1:f9:d2:1b:0a:
                    f8:ab:4b:ee:09:c5:45:c9:00:88:08:f9:2d:1c:c2:
                    9f:c6:f3:72:9e:7c:7c:3d:a6:7a:90:87:60:03:7c:
                    08:c2:08:0a:3f:84:a6:55:ea:f1:fd:0c:f5:60:0f:
                    70:6e:b9:78:4e:15:b6:66:e2:52:67:43:80:39:f8:
                    3d:89:d4:bc:ed:fa:bf:f8:8f:25:9b:4c:1c:3a:86:
                    9e:6a:0d:2a:76:54:c3:3e:dd:84:aa:20:cf:ba:96:
                    3f:bd:50:7b:c6:28:05:89:db:ec:47:70:c1:93:11:
                    63:a2:e1:d8:80:3d:84:e5:bf:10:48:85:69:b2:b9:
                    ba:11:1d:37:c6:80:11:96:7e:0f:96:88:49:77:a7:
                    fa:9b:c7:82:1f:7d:77:e0:5b:b5:eb:b3:a2:fb:75:
                    68:db:1d:fb:1d:77:7b:1c:b8:3e:52:fa:2d:18:73:
                    7f:b4:91:bc:ad:ff:4f:4d:5c:20:2e:9c:3f:ae:e4:
                    aa:fa:dc:45:d6:76:29:69:c4:02:be:dc:b3:6c:0e:
                    cf:9b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                0E:70:1A:81:B9:CE:B4:D5:C0:7B:DD:E8:50:18:1B:17:34:01:A0:9A
            X509v3 Authority Key Identifier:
                keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1

            Authority Information Access:
                OCSP - URI:http://ocsp.int-x3.letsencrypt.org
                CA Issuers - URI:http://cert.int-x3.letsencrypt.org/

            X509v3 Subject Alternative Name:
                DNS:gwendragon.de, DNS:www.gwendragon.de
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1
                  CPS: http://cps.letsencrypt.org
                  User Notice:
                    Explicit Text: This Certificate may only be relied upon by Relying Parties and only in accordance with the Certificate Policy found at https://letsencrypt.org/repository/

            CT Precertificate SCTs:
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : 55:81:D4:C2:16:90:36:01:4A:EA:0B:9B:57:3C:53:F0:
                                C0:E4:38:78:70:25:08:17:2F:A3:AA:1D:07:13:D3:0C
                    Timestamp : May 18 09:30:02.450 2018 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:4B:68:0B:C9:AE:EE:58:98:B6:02:84:FD:
                                A0:9F:AE:F2:BC:FF:7D:E5:52:24:DC:46:0D:CC:EA:A6:
                                E2:31:45:10:02:21:00:D1:9B:A1:3A:76:28:F1:89:21:
                                D6:B5:89:61:CA:1D:26:76:A9:78:75:2E:AA:F2:AA:CB:
                                C8:F0:95:E0:05:D8:36
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : 29:3C:51:96:54:C8:39:65:BA:AA:50:FC:58:07:D4:B7:
                                6F:BF:58:7A:29:72:DC:A4:C3:0C:F4:E5:45:47:F4:78
                    Timestamp : May 18 09:30:02.428 2018 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:44:02:20:65:DD:01:00:CF:79:06:80:EE:CC:4C:4C:
                                6F:1A:B1:B2:31:74:FD:74:8D:B2:11:C8:39:3B:B7:08:
                                EA:78:97:9D:02:20:19:FE:0B:1E:B4:6C:5C:28:9E:0F:
                                F1:40:21:DD:69:D0:9D:D2:08:FA:34:23:68:3E:F6:CD:
                                57:F3:C7:5C:B6:FB
    Signature Algorithm: sha256WithRSAEncryption
         41:59:5e:73:be:d2:7d:aa:66:eb:cf:bd:8c:fb:7e:58:bb:b8:
         ab:5e:ce:88:d5:3c:9c:f4:0d:14:d5:84:6f:6d:df:2d:85:34:
         0e:7c:b6:2c:17:d7:02:94:29:dc:60:53:37:2b:1c:59:0e:a5:
         bb:2b:93:51:1b:90:6f:e2:ac:d1:d4:56:b5:e9:ea:ad:3d:ff:
         f3:23:35:55:e0:53:0f:2e:29:15:fc:38:26:b2:35:14:dd:ae:
         ee:38:f7:e7:bc:55:f7:bd:66:88:1d:16:c5:c6:0b:2a:78:e4:
         46:a9:29:3a:2b:55:56:a4:22:d7:f6:2b:34:da:a8:da:17:05:
         8c:1f:88:02:f9:7e:8e:a2:d2:6d:0d:07:5c:9e:d2:c7:97:9c:
         14:76:ab:f4:4d:15:e1:b6:47:02:94:79:3d:a1:34:9f:f6:05:
         c8:eb:0a:15:b8:8a:d0:d3:c9:c3:9e:81:db:f3:51:2d:81:15:
         c5:bd:23:56:d2:88:40:c7:7b:a0:c3:bc:96:15:eb:92:db:e4:
         bb:67:fa:1f:c5:23:18:f1:01:c5:28:d2:1d:76:42:54:91:6d:
         91:7c:01:66:b8:a5:44:d0:a7:00:e4:84:b5:f0:eb:74:0e:10:
         02:c5:f3:ff:52:ea:68:77:52:01:fd:91:cb:64:7a:b9:24:13:
         b4:bd:16:3c