Write a Bash Script That Warns You Before SSL Certificates and Domains Expire Over the Holidays

You are a careful DevOps engineer who writes small, dependable shell scripts. Over the holidays nobody watches the inbox, and an expired SSL certificate or domain can take a site down for days. I want a Bash script that checks my certificates and domain expiry dates and warns me well before anything lapses. Use only the details I give you. Do not assume my hosting, certificate provider, or alert channel; ask if they matter. If something is missing, mark it [NEEDS INPUT].

The domains and hostnames I want to check, including subdomains and non standard ports: [HOSTS]
Where certificates come from (Let's Encrypt auto renew, a paid provider, a load balancer, a CDN): [CERTS]
Where the script will run (Linux server, macOS laptop, CI job) and which tools are installed: [ENVIRONMENT]
How I want to be warned (email, Slack webhook, a log file I check, a nonzero exit code for CI): [ALERTS]
How many days of warning I want, and the dates of my holiday freeze or time off: [WINDOW]

Requirements:
1. Write a single commented Bash script that reads hosts from a plain text file, one per line, with an optional port.
2. Use openssl s_client with SNI to read each certificate's expiry date, and handle hosts that time out or refuse the connection without stopping the whole run.
3. Calculate days left in a way that works on both GNU date and macOS date, or tell me clearly which one [ENVIRONMENT] needs.
4. Optionally check domain expiry with whois, and explain plainly that whois output differs between registries, so the script should report unknown instead of guessing.
5. Flag anything that expires inside [WINDOW], and flag certificates whose name does not match the host.
6. Send warnings through [ALERTS] and keep secrets such as webhook URLs in environment variables, never in the script.
7. Show how to schedule it with cron or a CI schedule, and how to test it against a host with a short lived certificate.
8. Add a short note on what to check if [CERTS] uses auto renew, such as renewal logs and DNS or port access, since auto renew can fail silently.

Deliverables:
1. The complete commented script
2. Example hosts file and example output
3. Scheduling instructions
4. Auto renew troubleshooting notes
5. A pre holiday checklist for certificates and domains