Summary:
We have a check for whenever the server cert is expiring within 1 day, however this turns out it doesn't count certificates that have already expired.
So adding a check for those that have already expired, and regenerating them if so.
We can safely handle parse failures by assuming the cert has expired.
Reviewed By: passy
Differential Revision: D8858740
fbshipit-source-id: 6e06f9b267bcaec497b7eedd3d6c1974c788aea2