Download all trusted NSS intermediates from Censys as PEM's (ignores roots)

censys_get_intermediates.py

from censys.certificates import CensysCertificates
import base64

query = "current_valid_nss: true AND parsed.extensions.basic_constraints.is_ca: true AND NOT current_in_nss: true"
fields = ["raw"]

def split(input, size):
    for start in range(0, len(input), size):
        yield input[start:start+size]

for idx, cert in enumerate(CensysCertificates().search(query, fields)):
    try:
        encoded = cert.get("raw")[0]
        total = len(encoded)
        print '-----BEGIN CERTIFICATE-----'
        for line in split(encoded, 64):
            print line
        print '-----END CERTIFICATE-----'
    except Exception as e:
        pass