Testing certificates for verdancy

[tashian]

I'd love to be able to know whether or not a certificate is about to expire, without running something like:

step certificate inspect $CERT_LOCATION --format json | \
        jq -e "(((.validity.start | fromdate) + \
                 ((.validity.end | fromdate) - (.validity.start | fromdate)) * 0.66) \
                  - now) <= 0'

For scripting purposes, I'd love a command such as step certificate verify --verdancy that would simply say whether or not the certificate is ready for renewal, and return an exit code:

• 0 GREEN — the leaf is < 66% through its lifetime
• 1 YELLOW — the leaf is >= 66% and < 90% through its lifetime
• 2 RED — the leaf is >= 90% through its lifetime
• 3 BROWN — the leaf is expired
• 255 if there was an error

[dopey]

step certificate expired and step certificate verdancy [**--expires-in**=<duration-or-% remaining>] <cert-or-url>

[tashian]

Can we do this for SSH certs too? This would allow the same systemd renewal method for SSH host certs.

[tommy-56]

step certificate needs-renewal addresses this issue and was merged in #495