Options for warning/critical days don't consider intermediate and root certificate(s) in the chain

[b2cc]

Currently check-tls-cert doesn't seem to consider the certificates in the chain when the --warning or --critical options are set. The script reports OK: all checks have been passed although certificates in the chain may expire within the given thresholds.

Consider the following situation in which the intermediate QuoVadis Global SSL ICA G3 will expire in ~21 days (2022-11-06), but the leaf certificate will expire in ~51 days (truncated output):

~# date
Sun 16 Oct 2022 01:34:52 PM UTC

~# ./check-tls-cert net -H bad-intermediate.example.com --ocsp no -v --warning 30 --critical 25
OK: all checks have been passed

[Certificate]
INFO: the certificate information is as follows
    Issuer : CN=QuoVadis Global SSL ICA G3, O=QuoVadis Limited, C=BM
    Subject: CN=bad-intermediate.example.com, O=Company, L=Zurich, ST=Zurich, C=CH
    Subject Alternative Name:
        DNS: bad-intermediate.example.com
    Validity:
        Not Before: 2021-12-07 08:55:38 +0000 UTC
        Not After : 2022-12-07 09:05:00 +0000 UTC

[Peer Certificate List]
OK: certificates are valid
    - OK: bad-intermediate.example.com
        Subject   : CN=bad-intermediate.example.com, O=Company, L=Zurich, ST=Zurich, C=CH
        Issuer    : CN=QuoVadis Global SSL ICA G3, O=QuoVadis Limited, C=BM
        Expiration: 2022-12-07 10:05:00 +0100
    - OK: QuoVadis Global SSL ICA G3
        Subject   : CN=QuoVadis Global SSL ICA G3, O=QuoVadis Limited, C=BM
        Issuer    : CN=QuoVadis Root CA 2 G3, O=QuoVadis Limited, C=BM
        Expiration: 2022-11-06 15:50:18 +0100

[ ... ]

[Summary]
OK: all checks have been passed

Version:

./git/tls_tools/check-tls-cert --version
check-tls-cert version 0.9.0

I think since this script has the options to check and alert in cases where certificates will run out shortly and need replacement, that it should also consider the certificates in the chain. Basically every modern browser or TLS client will refuse to connect if there is an expired certificate in the chain.

Thanks for your consideration and all the best!