export bao client-cert not_before/not_after gauges and alert past 80% of lifetime

swarm-secret-client/src/lib.rs

@@ -31,6 +31,7 @@
 
 pub mod acp;
 pub mod builder;
+pub mod cert;
 pub mod ci;
 pub mod ci_metrics;
 pub mod claude_login;
@@ -103,6 +104,10 @@ pub enum Error {
     /// identity needs. Names the field, never its value.
     #[error("the store issued a certificate whose {0} is empty")]
     IncompleteIssue(&'static str),
+
+    /// The text was not one PEM-encoded X.509 certificate.
+    #[error("decoding the certificate: {0}")]
+    Certificate(String),
 }
 
 impl From<vaultrs::error::ClientError> for Error {