tls-inspect

// tls.inspect: a TLS handshake that reads the certificate a port presents, and judges it without ever
// refusing it. It joins the address of the host.
need('host:address');

output('days-left', 'number', array('label' => 'Days before expiry', 'unit' => 'd'));

watch.below('expiring', 'Certificate expiring', 'days-left', array('warning' => 30, 'critical' => 7));

$found = tls.inspect(443);
// certificates: the chain as the server presents it, its own certificate first.
$leaf = $found['certificates'][0];
value('days-left', number.round($leaf['days_left'], 1));