Check every hostname in a file for a near-expiry certificate

while read -r h; do
  end=$(echo | openssl s_client -servername "$h" -connect "$h:443" 2>/dev/null 
        | openssl x509 -noout -enddate | cut -d= -f2)
  days=$(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 ))
  [ "$days" -lt 30 ] && echo "WARN $h $days"
done < hosts.txt