diff --git a/mbsync-get-cert b/mbsync-get-cert
index 19e1485..d8f194a 100755
--- a/mbsync-get-cert
+++ b/mbsync-get-cert
@@ -9,9 +9,25 @@
 # from a trusted source.
 #
 
-if [ $# != 1 ]; then
-	echo "Usage: $0 <host>" >&2
+usage() {
+	echo "Usage: $0 [-s] <host>" >&2
+	echo "  -s        Use IMAP+STARTTLS (port 143) instead of IMAPS (port 993)" >&2
 	exit 1
+}
+
+STARTTLS=false
+
+while getopts "s" opt; do
+	case $opt in
+	s) STARTTLS=true ;;
+	*) usage ;;
+	esac
+done
+
+shift `expr $OPTIND - 1`
+
+if [ $# -ne 1 ]; then
+	usage
 fi
 
 HOST=$1
@@ -33,7 +49,15 @@ TMPFILE=$TMPDIR/get-cert
 ERRFILE=$TMPDIR/get-cert-err
 CERTFILE=$TMPDIR/cert
 
-echo QUIT | openssl s_client -connect $HOST:993 -showcerts \
+if $STARTTLS; then
+	FLAGS="-starttls imap"
+	PORT=143
+else
+	FLAGS=
+	PORT=993
+fi
+
+echo QUIT | openssl s_client $FLAGS -connect $HOST:$PORT -showcerts \
 	> $TMPFILE 2> $ERRFILE
 sed -e '1,/^-----BEGIN CERTIFICATE-----/d' \
 	-e '/^-----END CERTIFICATE-----/,$d' < $TMPFILE > $CERTFILE