Certificate expiry as a metric, not a calendar reminder

A calendar reminder is a person, and a person on holiday is an outage; days-to-expiry as a metric is an alert like any other.

- alert: CertificateExpiringSoon
  expr: probe_ssl_earliest_cert_expiry - time() < 86400 * 21
  for: 1h
  labels: { severity: ticket }

- alert: CertificateExpiringUrgently
  expr: probe_ssl_earliest_cert_expiry - time() < 86400 * 5
  labels: { severity: page }

# earliest, so an intermediate expiring first is caught too.

earliest_cert_expiry across the chain is the correct thing to measure and is what the September incident argued for — measuring only the leaf would have shown twenty-eight comfortable days. Twenty-one days is enough notice for a manual renewal and enough time for an automated one to have failed several times. The two thresholds matter because a ticket at three weeks and a page at five days are different responses to the same fact.