Field guide to silent SSL expiry: what fails, what alerts you do and don't get, and how to catch the 30/14/3-day windows reliably.