Monitoring that reports an expired certificate is monitoring that reports an outage, and reading the file on disk misses the most common failure entirely.
#!/usr/bin/env bash
set -euo pipefail
for host in "$@"; do
end=$(echo | openssl s_client -servername "$host" -connect "$host:443" 2>/dev/null
| openssl x509 -noout -enddate | cut -d= -f2)
days=$(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 ))
[ "$days" -lt 30 ] && echo "WARN $host expires in $days days"
done
exit 0
Checking over the network rather than on disk catches the case where the certificate renewed correctly and the server is still serving the old one from memory — the most common failure and one a file check cannot see. Running it against every hostname including the redirect domains nobody remembers is where it earns its keep. The exit 0 at the end is deliberate: the script reports, and whatever runs it decides whether a warning is a failure.