An expiry alert at thirty days, not at zero

Monitoring that tells you a certificate has expired is monitoring that tells you about an outage. The useful alert fires while there is still time to fix the renewal.

#!/usr/bin/env bash
set -euo pipefail

for host in "$@"; do
    end=$(echo | openssl s_client -servername "$host" -connect "$host:443" 2>/dev/null 
        | openssl x509 -noout -enddate | cut -d= -f2)
    days=$(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 ))

    [ "$days" -lt 30 ] && echo "WARN $host expires in $days days"
done
exit 0

Checking from outside over the network rather than reading the file on disk is the important detail: it catches the case where the certificate renewed correctly and the server is still serving the old one, which is the most common failure and is invisible to a file check. Running it against every hostname including the ones nobody remembers is where it earns its keep — a redirect domain with an expired certificate still shows a browser warning.