The query below will give an overview of all hosts running expired certificates:

sourcetype="tenable:sc:vuln" synopsis="The remote server's SSL certificate has already expired." | dedup ip | chart count by ip