As always, you need a test that runs and notifies SRE or oncall. Ideally 14 or maybe 28 days before expiry.