OrionCMD Checks: Certificate status from CT logs + live HTTPS probe. Issuer, validity, days left, % of lifetime used, renewal cadence and a renewal-stall heuristic from Certificate Transparency logs (NOT the live served cert), plus a live HTTPS pass/fail probe from Cloudflare's edge.