docs: def download_as_der(
      base_url=d1_common.const.URL_DATAONE_ROOT,
      timeout_sec=d1_common.const.DEFAULT_HTTP_TIMEOUT,
  ):
      """Download public certificate from a TLS/SSL web server as DER encoded ``bytes``.
  
      If the certificate is being downloaded in order to troubleshoot validation issues,
      the download itself may fail due to the validation issue that is being investigated.
      To work around such chicken-and-egg problems, temporarily wrap calls to the
      download_* functions with the ``disable_cert_validation()`` context manager (also in
      this module).
  
      Args:
          base_url : str
            A full URL to a DataONE service endpoint or a server hostname
          timeout_sec : int or float
            Timeout for the SSL socket operations
      Returns:
        bytes: The server's public certificate as DER encoded bytes.
  
      """
      # TODO: It is unclear which SSL and TLS protocols are supported by the method
      # currently being used. The current method and the two commented out below
      # should be compared to determine which has the best compatibility with current
      # versions of Python and current best practices for protocol selection.
      sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
      sock.settimeout(timeout_sec)
      ssl_socket = ssl.wrap_socket(sock)
      url_obj = urllib.parse.urlparse(base_url)
      ssl_socket.connect((url_obj.netloc, 443))
      return ssl_socket.getpeercert(binary_form=True)