Certificate not-after checks belong in CI the same way lint does: fail the build when a public name would expire inside the paging window, not after a weekend outage. Probe the live listener from the pipeline, read the leaf not-after, and gate merge when remaining life drops under your renew SLA. Keep the check against the same SNI name clients dial, and store the threshold next to the renew job so ops and CI never drift. Alert on parse failures separately from short remaining life so a broken probe cannot look like a healthy certificate.

Ops prove-out after wiring the gate: run the job against a host with a short-lived leaf and confirm the pipeline fails before merge; then renew or swap the leaf and watch the same job go green. Flip the threshold temporarily and ensure only the expiry case fails, not unrelated handshake errors. Most surprise expiries are a renew that never ran plus a CI check that never dialed the public SNI — treat both as one control plane.