add certificate parsing to determine expiry