There is a simple 'certwatch' utility from crypto-utils package. The checking script is short: /etc/cron.daily/certwatch (example for httpd).

We want to implement something similar, but for Foreman and smart-proxy and add a dependency to the SPEC. This way, we can warn users one month in advance via cron.