Monitoring the renewal job answers whether it ran; monitoring the certificate answers whether it worked.
for host in $(./bin/tls-endpoints); do
end=$(echo | openssl s_client -connect "$host" -servername "${host%:*}"
2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
days=$(( ( $(date -d "$end" +%s) - $(date +%s) ) / 86400 ))
[ "$days" -lt 21 ] && echo "$host expires in $days days"
done
The check runs from outside and depends on none of the machinery that renews, deploys or reloads — which is the property that matters, because every previous failure was in one of those three. It is also the check that found a service nobody knew was serving TLS, which is a different and larger finding.