SSL certificate expiry checker

<?php

namespace App\Monitoring;

use RuntimeException;

final class SslExpiryChecker
{
    /**
     * @return array{host: string, issuer: string, subject: string, expires_at: \DateTimeImmutable, days_left: int}
     */
    public function check(string $host, int $port = 443, int $timeout = 8): array
    {
        $host = strtolower(trim($host));
        if (! preg_match('/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/', $host)) {
            throw new RuntimeException('Invalid host name.');
        }

        $context = stream_context_create(['ssl' => [
            'capture_peer_cert' => true,
            'SNI_enabled' => true,
            'peer_name' => $host,
            // We only read the dates, so an already-expired or self-signed cert must still connect.
            'verify_peer' => false,
            'verify_peer_name' => false,
        ]]);

        $socket = @stream_socket_client(
            "ssl://{$host}:{$port}", $errno, $error, $timeout, STREAM_CLIENT_CONNECT, $context
        );

        if ($socket === false) {
            throw new RuntimeException("TLS connection failed: {$error} ({$errno})");
        }

        $params = stream_context_get_params($socket);
        fclose($socket);

        $cert = openssl_x509_parse($params['options']['ssl']['peer_certificate'] ?? '');
        if (! $cert) {
            throw new RuntimeException('Could not read the certificate.');
        }

        $expires = (new \DateTimeImmutable)->setTimestamp($cert['validTo_time_t']);
        $seconds = $cert['validTo_time_t'] - time();

        return [
            'host' => $host,
            'issuer' => $cert['issuer']['O'] ?? $cert['issuer']['CN'] ?? 'unknown',
            'subject' => $cert['subject']['CN'] ?? $host,
            'expires_at' => $expires,
            // floor() so a cert that expired 3 hours ago reports -1, not 0.
            'days_left' => (int) floor($seconds / 86400),
        ];
    }
}