@Override
        public void run()
        {
            if (!ENABLED.getValue()) {
                Log.debug("Skipping TLS certificate expiry check, as it has been disabled by configuration.");
                return;
            }
            Log.debug("Starting TLS certificate expiry check.");

            try {
                final CertificateStoreManager certificateStoreManager = XMPPServer.getInstance().getCertificateStoreManager();

                // Openfire can use different identity stores for different types of connection. We'll iterate over all of them.
                final Set<IdentityStore> identityStores = new HashSet<>();
                for (final ConnectionType connectionType : ConnectionType.values()) {
                    identityStores.add(certificateStoreManager.getIdentityStore(connectionType));
                }

                // Time until expiry of the certificate with the lowest 'notAfter' value.
                Instant lowestNotAfter = Instant.MAX;

                for (final IdentityStore identityStore : identityStores) {
                    final Optional<Instant> oldest;
                        oldest = identityStore.getAllCertificates().values().stream()
                            .map(X509Certificate::getNotAfter)
                            .filter(Objects::nonNull)
                            .map(Date::toInstant)
                            .sorted()
                            .findFirst();

                    if (oldest.isPresent()) {
                        final Instant oldestDate = oldest.get();
                        if (oldestDate.isBefore(lowestNotAfter)) {
                            lowestNotAfter = oldestDate;
                        }
                    }
                }

                // Check if there's expired or nearly expired certificates.
                final boolean hasExpired = lowestNotAfter.isBefore(Instant.now());
                final boolean hasNearlyExpired = lowestNotAfter.minus(WARNING_PERIOD.getValue()).isBefore(Instant.now());
                if (hasExpired) {
                    Log.warn("One or more TLS certificates used by Openfire have expired. This can cause connectivity issues. Please use the Openfire Admin Console to review the state of all certificates in each of Openfire's \"identity\" certificate stores. Replace certificates where need.");
                    if (NOTIFY_ADMINS.getValue()) {
                        XMPPServer.getInstance().sendMessageToAdmins(LocaleUtils.getLocalizedString("ssl.certificates.expirycheck.notification-message.expired"));
                    }
                } else if (hasNearlyExpired) {
                    Log.info("One or more TLS certificates used by Openfire will expire soon. This can cause connectivity issues. Please use the Openfire Admin Console to review the state of all certificates in each of Openfire's \"identity\" certificate stores. Replace certificates where need.");
                    if (NOTIFY_ADMINS.getValue()) {
                        XMPPServer.getInstance().sendMessageToAdmins(LocaleUtils.getLocalizedString("ssl.certificates.expirycheck.notification-message.nearly-expired"));
                    }
                } else {
                    Log.debug("None of the TLS certificates used by Openfire have expired or will expire soon.");
                }
            } catch (Throwable e) {
                Log.warn("An unexpected exception prevented the period check for expired TLS certificates from executing successfully.", e);
            }
        }
How long before a TLS certificate will expire a warning is to be sent out to admins.
xmppserver/src/main/java/org/jivesoftware/util/cert/CertificateExpiryChecker.java