check for expired certs