- add support for 'openssl' - parse expiration date, failing if expired or if expires within 30 days - warn at 60