Never let an SSL certificate expire

import socket, ssl
from datetime import datetime, timezone
from google.oauth2.credentials import Credentials
from googleapiclient.discovery import build
from clickruntime import on_trigger, credentials, notify

SHEET_ID = "your-spreadsheet-id"

def days_left(domain):
    with socket.create_connection((domain, 443), timeout=10) as sock:
        with ssl.create_default_context().wrap_socket(sock, server_hostname=domain) as tls:
            expires = datetime.fromtimestamp(ssl.cert_time_to_seconds(tls.getpeercert()["notAfter"]), timezone.utc)
    return (expires - datetime.now(timezone.utc)).days

@on_trigger
def run(event):
    sheets = build("sheets", "v4", credentials=Credentials(credentials.connection("google", "work")), cache_discovery=False)
    domains = [r[0] for r in sheets.spreadsheets().values().get(spreadsheetId=SHEET_ID, range="Domains!A2:A")
               .execute().get("values", []) if r]
    days = [days_left(d) for d in domains]
    sheets.spreadsheets().values().update(spreadsheetId=SHEET_ID, range=f"Domains!B2:B{len(domains) + 1}",
                                          valueInputOption="RAW", body={"values": [[n] for n in days]}).execute()
    soon = [f"• {d}: {n} days left" for d, n in zip(domains, days) if n <= 21]
    if soon:
        notify.slack("🔐 SSL certificates expiring soon\n" + "\n".join(soon), channel="#ops")
    return {"checked": len(domains), "expiring": len(soon)}