various updates to checkcerts script

- add support for 'openssl'
- parse expiration date, failing if expired or if expires within 30 days
- warn at 60
remove debug text