Sort of old, but the old style Window Logs will output something like:
WARN - 1 WARN messages (Last worst: Jul 16 01:27:01 32768.64 AutoEnrollment local system)
(that’s actually how CheckMK reports it, just fyi)
a month before a cert in its store is going to expire. Doesn’t tell you what cert, but CheckMK will at least see this in the Log Application for any Windows host that has an expiring cert.
We actually have separate tool that shows us our certs on the network, but I have thought about using CheckMK (apart from the less than obvious warning message above you’ll get by default).