Puppet certificates

Does anyone have a good way to monitor the existence and age of puppet certificates in Nagios?