logic:

if certificate_validity_only:
    tls_config.verify_ca_chain = false
    tls_config.verify_hostname = false

    peer_certificate = tls_connection.get_peer_certificate()

    if peer_certificate is None:
        return UNKNOWN, "No certificate presented by server"

    not_before = peer_certificate.not_before
    not_after = peer_certificate.not_after

    remaining_days = calculate_days_until(not_after)

    if remaining_days < 0:
        return CRITICAL, "Certificate expired"

    if remaining_days <= critical:
        return CRITICAL, "Certificate expires soon"

    if remaining_days <= warning:
        return WARNING, "Certificate expires soon"

    return OK, "Certificate validity period OK"
else:
    perform_normal_certificate_validation()
	


install:

su - mysite
cd ~/local/lib/nagios/plugins
vi check_cert_validity_only.py
chmod +x check_cert_validity_only.py

test:

~/local/lib/nagios/plugins/check_cert_validity_only.py \
  -H customer-system.example.com \
  -p 443 \
  -w 30 \
  -c 14

or for different SNI

~/local/lib/nagios/plugins/check_cert_validity_only.py \
  -H 192.0.2.10 \
  -p 443 \
  --sni customer-system.example.com \
  -w 30 \
  -c 14
  
 CLI:
 
 check_httpv2 \
  --url https://customer-system.example.com \
  --certificate-levels 30,14 \
  --no-ca-validation \
  --no-hostname-validation \
  --check-certificate-dates
  
 CMK command:
 
 check_cert_validity_only.py -H $HOSTADDRESS$ -p 443 --sni $HOSTNAME$ -w 30 -c 14

or for different SNI

check_cert_validity_only.py \
  -H 10.20.30.40 \
  -p 443 \
  --sni portal.customer.local \
  -w 30 \
  -c 14
  
 CLI name

--certificate-validity-only

command
check_httpv2 --url https://host --certificate-levels 30,14 --certificate-validity-only