Download the certificate of a domain:

echo -n | openssl s_client -connect google.com:443 -servername google.com | openssl x509

Verify that the certificate corresponds to CA certificate:

openssl verify -verbose -purpose sslserver -CAfile /path/to/cafile.pem /path/to/cert.pem