Returns certificates for the domain that expire within days days from now. Useful for proactive renewal monitoring. Default window is 30 days.

Precert twin collapsing (GH #262): a CT precertificate and its final leaf are distinct rows (different SHA-256) describing the same logical certificate. By default this tool collapses each twin pair (same subject_cn, SAN set, not_before, not_after, issuer) to the final leaf so renewals aren't double-counted; the suppressed precert's fingerprint is exposed as precert_sha256 on the kept row, and total counts distinct certificates after collapsing. Pass collapse_precert_twins=false for the raw twin-per-row listing, or is_precert ("true"/"false"/empty, matching the submit_global_sweep contract) to filter to precerts or final leaves only.

Out-of-range days values are clamped into [1, 365] (0/negative → 1, >365 → 365); when that happens the response carries days_clamped: true plus days_requested (GH #189, mirrors the limit_clamped convention).

Self-healing for cold domains (task #113 / GH #266): if CertIndex has not indexed this domain yet, the response contains zero results plus a backfill_status sentinel. When backfill_status == 'in_progress', wait retry_after_seconds seconds and call this tool again. Use eta_basis for the stopping rule: 'live' = measured ETA; 'jobs_coarse' = coarse estimate from job-completion rate; 'unknown' = no projection — terminal_at_latest (ISO-8601 UTC) and seconds_until_terminal give the concrete stop point. in_progress_over_budget (no retry_after_seconds) means the projection exceeds the interactive budget — do NOT poll in a loop; retry much later (see hint). Any other status means the result will not change on retry.

Null crypto fields: on partially-indexed domains is_weak_crypto and key_type can be null — crypto metadata has not been extracted yet for those certificates. Treat null as UNKNOWN, never as 'not weak': all-null rows are not evidence that the domain has no weak-crypto certificates. To resolve a specific certificate, call get_certificate with its sha256_fingerprint and include_raw=true — that path re-derives key metadata from the raw certificate.