It would be useful to combine this with Grafana alerts, so check is triggered _before_ certificate is expired.