Replace expired certificate? about puppet-openssl HOT 1 OPEN

def exists?
  return false unless Pathname.new(resource[:path]).exist?

  debug 'Certificate found, checking validity.'
  cert = OpenSSL::X509::Certificate.new(File.read(resource[:path]))
  debug "Certificate parsed as #{cert.pretty_inspect}"
  raise 'No validity dates found in certificate.' if cert.not_before.nil? || cert.not_after.nil?

  (cert.not_after - Time.now).to_i > (30 * 24 * 3600) # certificate valid for more than 30 days
end