The query below will give an overview of all certificates about to expire (within 60 days)

 sourcetype="tenable:sc:vuln" synopsis="The SSL certificate associated with the remote service will expire soon." | dedup ip | lookup dnslookup clientip as ip | chart count by ip,clienthost