Every single time we deploy updates to our production code, we also simultaneously run a check against any main TLS certificates we use to see when they expire

Every single time we deploy updates to our production code, we also simultaneously run a check against any main TLS certificates we use to see when they expire -- it is built into the scripts used to verify the deployment. We also have certificate checks running weekly that alert to slack channels. While we cannot automate the select few on Digicert, we can automate any of the self-signed certificates (you can use your own CA still in 2023) or any of the Let's Encrypt ones.