#!/usr/bin/env bash
set -euo pipefail
cert_host=example.com
cert_file=$(mktemp)
trap 'rm -f "$cert_file"' EXIT

timeout 15 openssl s_client \
  -connect "${cert_host}:443" -servername "$cert_host" \
  -verify_hostname "$cert_host" -verify_return_error \
  -showcerts </dev/null >"$cert_file"
openssl x509 -in "$cert_file" -noout -subject -issuer -dates
openssl x509 -in "$cert_file" -noout -checkend 2592000