An expiry alert at thirty days, checked over the network

Monitoring that reports an expired certificate is monitoring that reports an outage, and reading the file on disk misses the most common failure entirely.

#!/usr/bin/env bash
set -euo pipefail

for host in "$@"; do
    end=$(echo | openssl s_client -servername "$host" -connect "$host:443" 2>/dev/null 
        | openssl x509 -noout -enddate | cut -d= -f2)
    days=$(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 ))

    [ "$days" -lt 30 ] && echo "WARN $host expires in $days days"
done
exit 0

Checking over the network rather than on disk catches the case where the certificate renewed correctly and the server is still serving the old one from memory — the most common failure and one a file check cannot see. Running it against every hostname including the redirect domains nobody remembers is where it earns its keep. The exit 0 at the end is deliberate: the script reports, and whatever runs it decides whether a warning is a failure.