How to Check SSL Certificate Expiry Before Browsers Start Warning

Auto-renewal fails quietly. Check the certificate your server actually sends with openssl, spot a renewed certificate that was never loaded, and trace a failed certbot renewal to the stage that broke.