diff --git a/src/common/tortls.c b/src/common/tortls.c
index 512847f1de..6c04a362a8 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -718,7 +718,7 @@ tor_tls_get_cert_digests(tor_tls_t *tls,
 {
   X509 *cert;
   unsigned int len;
-  tor_assert(tls->context);
+  tor_assert(tls && tls->context);
   cert = tls->context->my_cert;
   if (cert) {
     X509_digest(cert, EVP_sha1(), (unsigned char*)my_digest_out, &len);
@@ -734,6 +734,26 @@ tor_tls_get_cert_digests(tor_tls_t *tls,
   return 0;
 }
 
+/** DOCDOC */
+char *
+tor_tls_encode_my_certificate(tor_tls_t *tls, size_t *size_out,
+                              int conn_cert)
+{
+  unsigned char *result, *cp;
+  int certlen;
+  X509 *cert;
+  tor_assert(tls && tls->context);
+  cert = conn_cert ? tls->context->my_cert : tls->context->my_id_cert;
+  tor_assert(cert);
+  certlen = i2d_X509(cert, NULL);
+  tor_assert(certlen >= 0);
+  cp = result = tor_malloc(certlen);
+  i2d_X509(cert, &cp);
+  tor_assert(cp-result == certlen);
+  *size_out = (size_t)certlen;
+  return (char*) result;
+}
+
 /** Warn that a certificate lifetime extends through a certain range. */
 static void
 log_cert_lifetime(X509 *cert, const char *problem)
diff --git a/src/common/tortls.h b/src/common/tortls.h
index cbda57880c..639502e378 100644
--- a/src/common/tortls.h
+++ b/src/common/tortls.h
@@ -55,6 +55,8 @@ void tor_tls_free(tor_tls_t *tls);
 int tor_tls_peer_has_cert(tor_tls_t *tls);
 int tor_tls_get_cert_digests(tor_tls_t *tls, char *my_digest_out,
                              char *peer_digest_out);
+char *tor_tls_encode_my_certificate(tor_tls_t *tls, size_t *size_out,
+                                    int conn_cert);
 int tor_tls_verify_v1(int severity, tor_tls_t *tls,
                       crypto_pk_env_t **identity);
 int tor_tls_check_lifetime(tor_tls_t *tls, int tolerance);