Alerting on the served certificate rather than the renewal

Monitoring the renewal job answers whether it ran; monitoring the certificate answers whether it worked.

for host in $(./bin/tls-endpoints); do
  end=$(echo | openssl s_client -connect "$host" -servername "${host%:*}" 
        2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)

  days=$(( ( $(date -d "$end" +%s) - $(date +%s) ) / 86400 ))

  [ "$days" -lt 21 ] && echo "$host expires in $days days"
done

The check runs from outside and depends on none of the machinery that renews, deploys or reloads — which is the property that matters, because every previous failure was in one of those three. It is also the check that found a service nobody knew was serving TLS, which is a different and larger finding.