22 certs × SAN coverage, days-to-expire, ACME, key alg, OCSP stapling, key transparency (RFC 9162). Surfaces 4 expiring <30d + 2 weak-crypto + 1 missing-cert-transparency log entry.