Why each certificate is probed twice

⛔⛔ A FAILING check is the ALERT here, not an error — and that is what makes it ambiguous. cert.not_expiring_30d runs openssl x509 -checkend 2592000, which exits 0 when the certificate survives the next thirty days and non-zero when it does not. Measured live on 2026-07-30:

So the expiry check cannot tell "expires in nine days" from "this file is not a certificate" — both are exit 1. A watcher that read only that would report a corrupt path as an urgent renewal, and — far worse — would look identical whether it was watching a real certificate or a typo.

⇒ Every file gets a cert.subject_read probe as well. It succeeds on anything parseable and fails on anything else, which separates the three outcomes cleanly: readable ∧ ¬expiring is healthy, readable ∧ expiring is the alert, and ¬readable is unreadable and never counted as healthy.

⚠ The foreach is what makes this safe. A foreach step collects per-item failures as {ok:false} and still returns normally, so an expiring certificate — which IS a failing step — cannot end the run before the others are checked. That is also why these checks are not prefetch steps: the list of certificates is itself a step result, and prefetch runs in parallel and cannot read one.

⚠ Thirty days is fixed by the operation, not chosen here. cert.not_expiring_30d hard-codes -checkend 2592000; there is no shorter or longer horizon available, so this recipe cannot offer one. A different window needs a new operation in the openssl-x509 pack.

⚠ This reads certificate FILES on disk. There is no operation in the pack that fetches a certificate from a live host, so this watches the files your server already has — an ACME-issued chain, a bundle you were sent — not a remote endpoint's live certificate. Those are different claims and this makes the weaker one.

⚠ expiring includes ALREADY EXPIRED. -checkend answers one question — "will it still be valid then" — and a certificate that lapsed last month fails it exactly as one lapsing next week does. Read Expires for which it is.