When I received the first warning email about this, I wrote a simple library and cli to validate all my certs for me.
replies(2):
#!/usr/bin/env bash
cert_check() {
server=$1
host=$2
port=$3
str=`ssh "$server" "echo | openssl s_client -servername $host -connect localhost:$port | openssl x509 -noout -checkend 604800"` || true
if ! echo "$str" | grep -q 'Certificate will not expire' ; then
echo "$str" | ./send-email.py "Certificate \"$host\" on $server will expire in 7 days" \
fi
}
cert_check name myserver.com 443