diff --git a/aci-preupgrade-validation-script.py b/aci-preupgrade-validation-script.py
index 5e79f56..f0291da 100644
--- a/aci-preupgrade-validation-script.py
+++ b/aci-preupgrade-validation-script.py
@@ -6702,6 +6702,116 @@ def stale_dbgacEpgSummaryTask_check(tversion, **kwargs):
     return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
 
 
+@check_wrapper(check_title='Certificate Expiration Check')
+def certificate_expiration_check(cversion, username, password, fabric_nodes, **kwargs):
+    result = PASS
+    headers = ["Fault Code", "Severity", "Description"]
+    data = []
+    recommended_action = ""
+    doc_url = 'https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#certificate-expiration-check'
+
+    fault_min_versions = [
+        ("F4501", "6.0(4c)"), ("F4502", "6.0(4c)"),  # KeyRing cert expiring/expired
+        ("F4503", "6.1(1e)"), ("F4617", "6.1(1e)"),  # TP cert expired/expiring
+        ("F3081", "3.1(2f)"), ("F3082", "3.1(2f)"),  # SAML encryption cert expiring/expired
+        ("F4752", "6.1(5e)"), ("F4753", "6.1(5e)"),  # Factory certificate expired/expiring
+    ]
+    FACTORY_CERT_MIN_VERSION = "6.1(5e)"
+    FACTORY_CERT_EXPIRING_DAYS = 30
+
+    has_critical = has_major = has_error = False
+
+    applicable_codes = [code for code, ver in fault_min_versions if not cversion.older_than(ver)]
+    if applicable_codes:
+        fault_filter = ",".join('eq(faultInst.code,"{}")'.format(code) for code in applicable_codes)
+        for faultInst in icurl('class', 'faultInst.json?query-target-filter=or({})'.format(fault_filter)):
+            fault_attrs = faultInst['faultInst']['attributes']
+            if fault_attrs['lc'] not in ("raised", "soaking"):
+                continue
+            data.append([fault_attrs['code'], fault_attrs['severity'], fault_attrs['descr']])
+            if fault_attrs['severity'] == 'critical':
+                has_critical = True
+            elif fault_attrs['severity'] == 'major':
+                has_major = True
+
+    if cversion.older_than(FACTORY_CERT_MIN_VERSION) and username and password:
+        date_format = "%b %d %H:%M:%S %Y"
+        current_date_re = re.compile(
+            r'[A-Z][a-z]{2}\s+(?P<mon>[A-Z][a-z]{2})\s+(?P<day>\d+)\s+(?P<time>\d{2}:\d{2}:\d{2})\s+\w+\s+(?P<year>\d{4})'
+        )
+        cert_expiry_re = re.compile(
+            r'notAfter=(?P<date>[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\d{4})'
+        )
+
+        controllers = (node for node in fabric_nodes if node["fabricNode"]["attributes"]["role"] == "controller")
+        controllers = list(controllers)
+        for controller in controllers:
+            node_attrs = controller["fabricNode"]["attributes"]
+            node_id = node_attrs["id"]
+            node_name = node_attrs["name"]
+            node_addr = node_attrs.get("address")
+            if not node_addr:
+                continue
+            try:
+                c = Connection(node_addr)
+                c.username = username
+                c.password = password
+                c.log = LOG_FILE
+                c.connect()
+                c.cmd("date")
+                current_date_match = current_date_re.search(c.output)
+                c.cmd("acidiag verifyapic")
+                cert_expiry_match = cert_expiry_re.search(c.output)
+            except Exception as e:
+                data.append(["N/A", "error",
+                             "APIC {} ({}): unable to verify factory certificate - {}".format(node_id, node_name, e)])
+                has_error = True
+                continue
+
+            try:
+                current_date = datetime.strptime(
+                    "{mon} {day} {time} {year}".format(**current_date_match.groupdict()), date_format
+                )
+            except (AttributeError, ValueError):
+                data.append(["N/A", "error",
+                             "APIC {} ({}): unable to determine current date".format(node_id, node_name)])
+                has_error = True
+                continue
+
+            try:
+                cert_expiry = datetime.strptime(" ".join(cert_expiry_match.group("date").split()), date_format)
+            except (AttributeError, ValueError):
+                data.append(["N/A", "error",
+                             "APIC {} ({}): unable to determine factory certificate expiry date".format(node_id, node_name)])
+                has_error = True
+                continue
+
+            if cert_expiry <= current_date:
+                data.append(["N/A", "critical",
+                             "APIC {} ({}): factory certificate expired on {} UTC".format(node_id, node_name, cert_expiry)])
+                has_critical = True
+            elif (cert_expiry - current_date).days <= FACTORY_CERT_EXPIRING_DAYS:
+                data.append(["N/A", "major",
+                             "APIC {} ({}): factory certificate expiring on {} UTC".format(node_id, node_name, cert_expiry)])
+                has_major = True
+
+    if data:
+        if has_error:
+            result = ERROR
+            recommended_action = 'Manually verify the factory certificate expiry using `acidiag verifyapic` on the affected APIC(s).'
+        elif has_critical and has_major:
+            result = FAIL_O
+            recommended_action = 'Renew expired certificate(s) immediately. For certificate(s) approaching expiry, renew before they expire to avoid service disruption.'
+        elif has_critical:
+            result = FAIL_O
+            recommended_action = 'Renew the certificate(s) immediately to restore functionality.'
+        elif has_major:
+            result = MANUAL
+            recommended_action = 'Renew the certificate(s) before they expire to avoid service disruption.'
+
+    return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
+
+
 # ---- Script Execution ----
 
 
@@ -6816,6 +6926,7 @@ class CheckManager:
         equipment_disk_limits_exceeded,
         apic_vmm_inventory_sync_faults_check,
         apic_storage_inode_check,
+        certificate_expiration_check,
 
         # Configurations
         vpc_paired_switches_check,
diff --git a/docs/docs/validations.md b/docs/docs/validations.md
index f788681..0152c67 100644
--- a/docs/docs/validations.md
+++ b/docs/docs/validations.md
@@ -87,6 +87,7 @@ Items                                         | Faults         | This Script
 [Equipment Disk Limits][f20]                  | F1820: 80% -minor<br>F1821: -major<br>F1822: -critical | :white_check_mark: | :no_entry_sign:
 [VMM Inventory Partially Synced][f21]         | F0132: comp-ctrlr-operational-issues | :white_check_mark: | :no_entry_sign:
 [APIC Storage Inode Usage][f22]               | F4388: 75% - 85% -warning<br>F4389: 85% - 90% -major<br>F4390: 90% or more -critical | :white_check_mark: | :no_entry_sign:
+[Certificate Expiration Check][f23]           | F4501/F4502: KeyRing expiring/expired<br>F4617/F4503: TP expiring/expired<br>F3081/F3082: SAML expiring/expired<br>F4752/F4753: Factory expiring/expired | :white_check_mark: | :no_entry_sign:
 
 [f1]: #apic-disk-space-usage
 [f2]: #standby-apic-disk-space-usage
@@ -110,6 +111,7 @@ Items                                         | Faults         | This Script
 [f20]: #equipment-disk-limits
 [f21]: #vmm-inventory-partially-synced
 [f22]: #apic-storage-inode-usage
+[f23]: #certificate-expiration-check
 
 ### Configuration Checks
 
@@ -1639,7 +1641,115 @@ To recover from this fault, try the following action
     type            : operational
     ```
     
-    
+### Certificate Expiration Check
+
+ACI uses various X.509 certificates for security and authentication purposes. If these certificates expire or are about to expire, it can cause service disruptions or failures. The fabric will raise different faults depending on the certificate type.
+
+**Expiring Certificates (Major Severity):**
+
+* **F4501**: KeyRing X.509 Certificate expiring - This fault occurs when a custom KeyRing X.509 Certificate is going to expire in one month.
+
+* **F3081**: SAML X.509 Certificate expiring - This fault occurs when the SAML X.509 Certificate is going to expire in one month.
+
+* **F4617**: TP X.509 Certificate expiring - This fault occurs when a Trust Point X.509 Certificate is expiring.
+
+* **F4752**: Factory X.509 Certificate expiring - This fault occurs when the factory Certificate is expiring.
+
+
+**Expired Certificates (Critical Severity):**
+
+* **F4502**: KeyRing X.509 Certificate expired - This fault occurs when a custom KeyRing X.509 Certificate has expired.
+
+* **F4503**: TP X.509 Certificate expired - This fault occurs when a Trust Point X.509 Certificate has expired.
+
+* **F3082**: SAML X.509 Certificate expired - This fault occurs when the SAML Encryption X.509 Certificate has expired.
+
+* **F4753**: Factory X.509 Certificate expired - This fault occurs when the factory Certificate has expired.
+
+
+**Recommended Actions:**
+
+* For expiring certificates (F4501, F3081, F4617, F4752): Renew the certificate(s) before they expire to avoid service disruption.
+
+* For expired certificates (F4502, F4503, F3082, F4753): Renew the certificate(s) immediately to restore functionality.
+
+!!! example "Fault Example (F4502: Expired KeyRing Certificate)"
+    The following shows an example of an expired KeyRing certificate:
+    ```
+    admin@apic1:~> moquery -c faultInst -f 'fault.Inst.code=="F4502"'
+    Total Objects shown: 1
+     
+    # fault.Inst
+    code             : F4502
+    ack              : no
+    alert            : no
+    annotation       :
+    cause            : cert-expired
+    changeSet        :
+    childAction      :
+    created          : 2026-05-12T05:23:26.549+00:00
+    delegated        : no
+    descr            : KeyRing Certificate THD_KEYRING expired
+    dn               : uni/userext/pkiext/keyring-THD_KEYRING/fault-F4502
+    domain           : security
+    extMngdBy        : undefined
+    highestSeverity  : critical
+    lastTransition   : 2026-05-12T05:25:51.231+00:00
+    lc               : raised
+    modTs            : never
+    occur            : 1
+    origSeverity     : critical
+    prevSeverity     : critical
+    rn               : fault-F4502
+    rule             : pki-key-ring-custom-key-ring-expired
+    severity         : critical
+    status           :
+    subject          : security-provider
+    title            :
+    type             : operational
+    uid              :
+    userdom          : all
+    ```
+
+!!! example "Fault Example (F4501: Expiring KeyRing Certificate)"
+    The following shows an example of a KeyRing certificate expiring in one month:
+    ```
+    admin@apic1:~> moquery -c faultInst -f 'fault.Inst.code=="F4501"'
+    Total Objects shown: 1
+     
+    # fault.Inst
+    code             : F4501
+    ack              : no
+    alert            : no
+    annotation       :
+    cause            : cert-expiring
+    changeSet        :
+    childAction      :
+    created          : 2026-04-12T05:23:26.549+00:00
+    delegated        : no
+    descr            : KeyRing Certificate THD_KEYRING expiring in one month
+    dn               : uni/userext/pkiext/keyring-THD_KEYRING/fault-F4501
+    domain           : security
+    extMngdBy        : undefined
+    highestSeverity  : major
+    lastTransition   : 2026-04-12T05:25:51.231+00:00
+    lc               : raised
+    modTs            : never
+    occur            : 1
+    origSeverity     : major
+    prevSeverity     : major
+    rn               : fault-F4501
+    rule             : pki-key-ring-custom-key-ring-expiring
+    severity         : major
+    status           :
+    subject          : security-provider
+    title            :
+    type             : operational
+    uid              :
+    userdom          : all
+    ```
+
+
 ## Configuration Check Details
 
 ### VPC-paired Leaf switches                       
diff --git a/tests/checks/certificate_expiration_check/faultInst_F3081.json b/tests/checks/certificate_expiration_check/faultInst_F3081.json
new file mode 100644
index 0000000..6c861e3
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_F3081.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F3081",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "SAML Signing Certificate expiring in one month",
+                "dn": "uni/userext/samlext/samlidp-IDP1/fault-F3081"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_F3082.json b/tests/checks/certificate_expiration_check/faultInst_F3082.json
new file mode 100644
index 0000000..554a083
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_F3082.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F3082",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "SAML Encryption Certificate has expired",
+                "dn": "uni/userext/samlext/samlencert-default/fault-F3082"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_F4501.json b/tests/checks/certificate_expiration_check/faultInst_F4501.json
new file mode 100644
index 0000000..099878e
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_F4501.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4501",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "KeyRing Certificate THD_KEYRING expiring",
+                "dn": "uni/userext/pkiext/keyring-THD_KEYRING/fault-F4501"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_F4502.json b/tests/checks/certificate_expiration_check/faultInst_F4502.json
new file mode 100644
index 0000000..cebb5b1
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_F4502.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4502",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "KeyRing Certificate THD_KEYRING expired",
+                "dn": "uni/userext/pkiext/keyring-THD_KEYRING/fault-F4502"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_F4503.json b/tests/checks/certificate_expiration_check/faultInst_F4503.json
new file mode 100644
index 0000000..3121a85
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_F4503.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4503",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "TP Certificate THD_CA expired",
+                "dn": "uni/userext/pkiext/tp-THD_CA/fault-F4503"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_F4617.json b/tests/checks/certificate_expiration_check/faultInst_F4617.json
new file mode 100644
index 0000000..67f6169
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_F4617.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4617",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "TP Certificate expiring",
+                "dn": "uni/fabric/comm-default/https/fault-F4617"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_F4752.json b/tests/checks/certificate_expiration_check/faultInst_F4752.json
new file mode 100644
index 0000000..068d976
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_F4752.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4752",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "Factory certificate expiring",
+                "dn": "topology/pod-1/node-1/sys/ch/fault-F4752"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_F4753.json b/tests/checks/certificate_expiration_check/faultInst_F4753.json
new file mode 100644
index 0000000..68a9882
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_F4753.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4753",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "Factory certificate expired",
+                "dn": "topology/pod-1/node-1/sys/ch/fault-F4753"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_cleared.json b/tests/checks/certificate_expiration_check/faultInst_cleared.json
new file mode 100644
index 0000000..eaeda0d
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_cleared.json
@@ -0,0 +1,13 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4502",
+                "severity": "critical",
+                "lc": "retaining",
+                "descr": "KeyRing Certificate THD_KEYRING expired",
+                "dn": "uni/userext/pkiext/keyring-THD_KEYRING/fault-F4502"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_mixed.json b/tests/checks/certificate_expiration_check/faultInst_mixed.json
new file mode 100644
index 0000000..45971d9
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_mixed.json
@@ -0,0 +1,46 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4501",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "KeyRing Certificate KEYRING1 expiring",
+                "dn": "uni/userext/pkiext/keyring-KEYRING1/fault-F4501"
+            }
+        }
+    },
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4502",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "KeyRing Certificate THD_KEYRING expired",
+                "dn": "uni/userext/pkiext/keyring-THD_KEYRING/fault-F4502"
+            }
+        }
+    },
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F3081",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "SAML Signing Certificate expiring in one month",
+                "dn": "uni/userext/samlext/samlidp-IDP1/fault-F3081"
+            }
+        }
+    },
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F3082",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "SAML Encryption Certificate has expired",
+                "dn": "uni/userext/samlext/samlencert-default/fault-F3082"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_multiple_expired.json b/tests/checks/certificate_expiration_check/faultInst_multiple_expired.json
new file mode 100644
index 0000000..2c60383
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_multiple_expired.json
@@ -0,0 +1,35 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4502",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "KeyRing Certificate THD_KEYRING expired",
+                "dn": "uni/userext/pkiext/keyring-THD_KEYRING/fault-F4502"
+            }
+        }
+    },
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4503",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "TP Certificate THD_CA expired",
+                "dn": "uni/userext/pkiext/tp-THD_CA/fault-F4503"
+            }
+        }
+    },
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F3082",
+                "severity": "critical",
+                "lc": "raised",
+                "descr": "SAML Encryption Certificate has expired",
+                "dn": "uni/userext/samlext/samlencert-default/fault-F3082"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/faultInst_multiple_expiring.json b/tests/checks/certificate_expiration_check/faultInst_multiple_expiring.json
new file mode 100644
index 0000000..fcb1478
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/faultInst_multiple_expiring.json
@@ -0,0 +1,35 @@
+[
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4501",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "KeyRing Certificate THD_KEYRING expiring",
+                "dn": "uni/userext/pkiext/keyring-THD_KEYRING/fault-F4501"
+            }
+        }
+    },
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F3081",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "SAML Signing Certificate expiring in one month",
+                "dn": "uni/userext/samlext/samlidp-IDP1/fault-F3081"
+            }
+        }
+    },
+    {
+        "faultInst": {
+            "attributes": {
+                "code": "F4617",
+                "severity": "major",
+                "lc": "raised",
+                "descr": "TP Certificate expiring",
+                "dn": "uni/fabric/comm-default/https/fault-F4617"
+            }
+        }
+    }
+]
\ No newline at end of file
diff --git a/tests/checks/certificate_expiration_check/test_certificate_expiration_check.py b/tests/checks/certificate_expiration_check/test_certificate_expiration_check.py
new file mode 100644
index 0000000..09fe2d9
--- /dev/null
+++ b/tests/checks/certificate_expiration_check/test_certificate_expiration_check.py
@@ -0,0 +1,442 @@
+import os
+import pytest
+import logging
+import importlib
+from helpers.utils import read_data
+
+script = importlib.import_module("aci-preupgrade-validation-script")
+Result = script.Result
+
+log = logging.getLogger(__name__)
+dir = os.path.dirname(os.path.abspath(__file__))
+
+test_function = "certificate_expiration_check"
+
+
+# Fault codes in the same order as `fault_min_versions` (dict insertion order),
+# which is the order the check builds the OR filter.
+MASTER_ORDER = ["F4501", "F4502", "F4503", "F4617", "F3081", "F3082", "F4752", "F4753"]
+
+
+def fault_query(codes):
+    ordered = [c for c in MASTER_ORDER if c in codes]
+    return 'faultInst.json?query-target-filter=or({})'.format(
+        ",".join('eq(faultInst.code,"{}")'.format(c) for c in ordered)
+    )
+
+
+# icurl queries per applicable version range
+faultInst = fault_query(MASTER_ORDER)
+faultInst_pre_factory = fault_query(["F4501", "F4502", "F4503", "F4617", "F3081", "F3082"])
+faultInst_keyring_saml = fault_query(["F4501", "F4502", "F3081", "F3082"])
+faultInst_saml = fault_query(["F3081", "F3082"])
+
+
+# --- Factory certificate (F4752/F4753) SSH check test data ---
+fabric_nodes_ssh = [
+    {"fabricNode": {"attributes": {"id": "1", "name": "apic1", "role": "controller", "address": "10.0.0.1"}}},
+]
+
+fabric_nodes_multi = [
+    {"fabricNode": {"attributes": {"id": "1", "name": "apic1", "role": "controller", "address": "10.0.0.1"}}},
+    {"fabricNode": {"attributes": {"id": "2", "name": "apic2", "role": "controller", "address": "10.0.0.2"}}},
+    {"fabricNode": {"attributes": {"id": "3", "name": "apic3", "role": "controller", "address": "10.0.0.3"}}},
+]
+
+DATE_OUTPUT = "Wed Jul 15 06:35:30 UTC 2026\nfab-apic#"
+
+VERIFYAPIC_EXPIRED = """\
+openssl_check: Manufacturing certificate details
+issuer=CN=Cisco Manufacturing CA,O=Cisco Systems
+notBefore=Jul  6 19:33:57 2019 GMT
+notAfter=May 14 20:25:42 2024 GMT
+openssl_check: passed
+all_checks: passed
+"""
+
+VERIFYAPIC_EXPIRING = """\
+openssl_check: Manufacturing certificate details
+issuer=CN=Cisco Manufacturing CA,O=Cisco Systems
+notBefore=Jul  6 19:33:57 2019 GMT
+notAfter=Aug  1 06:57:40 2026 GMT
+openssl_check: passed
+all_checks: passed
+"""
+
+VERIFYAPIC_VALID = """\
+openssl_check: Manufacturing certificate details
+issuer=CN=Cisco Manufacturing CA,O=Cisco Systems
+notBefore=Jul  6 19:33:57 2019 GMT
+notAfter=May 14 20:25:42 2029 GMT
+openssl_check: passed
+all_checks: passed
+"""
+
+
+def ssh_cmds(outputs):
+    if isinstance(outputs, str):
+        outputs = {"10.0.0.1": outputs}
+    return {
+        addr: [
+            {"cmd": "date", "output": DATE_OUTPUT, "exception": None},
+            {"cmd": "acidiag verifyapic", "output": out, "exception": None},
+        ]
+        for addr, out in outputs.items()
+    }
+
+@pytest.mark.parametrize(
+    "icurl_outputs, conn_failure, conn_cmds, cversion, fabric_nodes, expected_result, expected_data",
+    [
+        
+        # ==== cversion >= 6.1(5e): all 8 fault codes, SSH skipped ====
+
+        # PASS - no certificate faults
+        (
+            {
+                faultInst: []
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.PASS,
+            [],
+        ),
+        # MANUAL - only expiring certificate (F4501 - KeyRing)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_F4501.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)",
+            [],
+            script.MANUAL,
+            [
+                ["F4501", "major", "KeyRing Certificate THD_KEYRING expiring"],
+            ],
+        ),
+        # MANUAL - only expiring certificate (F3081 - SAML)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_F3081.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.MANUAL,
+            [
+                ["F3081", "major", "SAML Signing Certificate expiring in one month"],
+            ],
+        ),
+        # MANUAL - only expiring certificate (F4617 - TP)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_F4617.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.MANUAL,
+            [
+                ["F4617", "major", "TP Certificate expiring"],
+            ],
+        ),
+        # MANUAL - only expiring factory certificate (F4752 - Factory)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_F4752.json")
+            },
+            False,
+            {},
+            "6.1(5e)",
+            [],
+            script.MANUAL,
+            [
+                ["F4752", "major", "Factory certificate expiring"],
+            ],
+        ),
+        # MANUAL - multiple expiring certificates
+        (
+            {
+                faultInst: read_data(dir, "faultInst_multiple_expiring.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.MANUAL,
+            [
+                ["F4501", "major", "KeyRing Certificate THD_KEYRING expiring"],
+                ["F3081", "major", "SAML Signing Certificate expiring in one month"],
+                ["F4617", "major", "TP Certificate expiring"],
+            ],
+        ),
+        # FAIL_O - only expired certificate (F4502 - KeyRing)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_F4502.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.FAIL_O,
+            [
+                ["F4502", "critical", "KeyRing Certificate THD_KEYRING expired"],
+            ],
+        ),
+        # FAIL_O - only expired certificate (F4503 - TP)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_F4503.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.FAIL_O,
+            [
+                ["F4503", "critical", "TP Certificate THD_CA expired"],
+            ],
+        ),
+        # FAIL_O - only expired certificate (F3082 - SAML)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_F3082.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.FAIL_O,
+            [
+                ["F3082", "critical", "SAML Encryption Certificate has expired"],
+            ],
+        ),
+        # FAIL_O - only expired factory certificate (F4753 - Factory)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_F4753.json")
+            },
+            False,
+            {},
+            "6.1(5e)",
+            [],
+            script.FAIL_O,
+            [
+                ["F4753", "critical", "Factory certificate expired"],
+            ],
+        ),
+        # FAIL_O - multiple expired certificates
+        (
+            {
+                faultInst: read_data(dir, "faultInst_multiple_expired.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.FAIL_O,
+            [
+                ["F4502", "critical", "KeyRing Certificate THD_KEYRING expired"],
+                ["F4503", "critical", "TP Certificate THD_CA expired"],
+                ["F3082", "critical", "SAML Encryption Certificate has expired"],
+            ],
+        ),
+        # FAIL_O - mixed: both expiring and expired certificates (expired takes priority)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_mixed.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.FAIL_O,
+            [
+                ["F4501", "major", "KeyRing Certificate KEYRING1 expiring"],
+                ["F4502", "critical", "KeyRing Certificate THD_KEYRING expired"],
+                ["F3081", "major", "SAML Signing Certificate expiring in one month"],
+                ["F3082", "critical", "SAML Encryption Certificate has expired"],
+            ],
+        ),
+        # PASS - faults exist but not in raised/soaking state (cleared/retaining)
+        (
+            {
+                faultInst: read_data(dir, "faultInst_cleared.json")
+            },
+            False, 
+            {}, 
+            "6.1(5e)", 
+            [],
+            script.PASS,
+            [],
+        ),
+
+        # ==== Version gating: only applicable fault codes are queried ====
+
+        # 6.1(1e) <= cversion < 6.1(5e): 6 codes (no factory). TP expired.
+        (
+            {
+                faultInst_pre_factory: read_data(dir, "faultInst_F4503.json")
+            },
+            False, 
+            {}, 
+            "6.1(1e)", 
+            [],
+            script.FAIL_O,
+            [
+                ["F4503", "critical", "TP Certificate THD_CA expired"],
+            ],
+        ),
+        # 6.0(4c) <= cversion < 6.1(1e): KeyRing + SAML only. KeyRing expired.
+        (
+            {
+                faultInst_keyring_saml: read_data(dir, "faultInst_F4502.json")
+            },
+            False, 
+            {}, 
+            "6.0(4c)", 
+            [],
+            script.FAIL_O,
+            [
+                ["F4502", "critical", "KeyRing Certificate THD_KEYRING expired"],
+            ],
+        ),
+        # 3.1(2f) <= cversion < 6.0(4c): SAML only. Expired.
+        (
+            {
+                faultInst_saml: read_data(dir, "faultInst_F3082.json")
+            },
+            False, 
+            {}, 
+            "5.2(7g)", 
+            [],
+            script.FAIL_O,
+            [
+                ["F3082", "critical", "SAML Encryption Certificate has expired"],
+            ],
+        ),
+        # 3.1(2f) <= cversion < 6.0(4c): SAML only, none raised.
+        (
+            {faultInst_saml: []},
+            False, 
+            {}, 
+            "5.2(7g)", 
+            [],
+            script.PASS,
+            [],
+        ),
+        # cversion < 3.1(2f): no applicable fault codes, no fault query issued.
+        (
+            {}, 
+            False, 
+            {}, 
+            "2.3(1a)", 
+            [],
+            script.PASS,
+            [],
+        ),
+
+        # ==== Factory certificate SSH check (cversion < 6.1(5e)) ====
+
+        # PASS - manufacturing certificate valid (far future)
+        (
+            {
+                faultInst_pre_factory: []
+            },
+            False, 
+            ssh_cmds(VERIFYAPIC_VALID), 
+            "6.1(4a)", 
+            fabric_nodes_ssh,
+            script.PASS,
+            [],
+        ),
+        # FAIL_O - manufacturing certificate expired
+        (
+            {
+                faultInst_pre_factory: []
+            },
+            False, 
+            ssh_cmds(VERIFYAPIC_EXPIRED), 
+            "6.1(4a)", 
+            fabric_nodes_ssh,
+            script.FAIL_O,
+            [
+                ["N/A", "critical",
+                 "APIC 1 (apic1): factory certificate expired on 2024-05-14 20:25:42 UTC"],
+            ],
+        ),
+        # MANUAL - manufacturing certificate expiring within threshold (30 days)
+        (
+            {faultInst_pre_factory: []},
+            False, 
+            ssh_cmds(VERIFYAPIC_EXPIRING), 
+            "6.1(4a)", 
+            fabric_nodes_ssh,
+            script.MANUAL,
+            [
+                ["N/A", "major",
+                 "APIC 1 (apic1): factory certificate expiring on 2026-08-01 06:57:40 UTC"],
+            ],
+        ),
+        # ERROR - SSH connection failure while verifying manufacturing certificate
+        (
+            {
+                faultInst_pre_factory: []
+            },
+            True, 
+            {}, 
+            "6.1(4a)", 
+            fabric_nodes_ssh,
+            script.ERROR,
+            [
+                ["N/A", "error",
+                 "APIC 1 (apic1): unable to verify factory certificate - Simulated exception at connect()"],
+            ],
+        ),
+        # FAIL_O - combined: a raised fault AND an expired manufacturing cert (both reported)
+        (
+            {faultInst_pre_factory: read_data(dir, "faultInst_F4502.json")},
+            False, 
+            ssh_cmds(VERIFYAPIC_EXPIRED), 
+            "6.1(4a)", 
+            fabric_nodes_ssh,
+            script.FAIL_O,
+            [
+                ["F4502", "critical", "KeyRing Certificate THD_KEYRING expired"],
+                ["N/A", "critical",
+                 "APIC 1 (apic1): factory certificate expired on 2024-05-14 20:25:42 UTC"],
+            ],
+        ),
+        # FAIL_O - 3 APICs, only apic2 has an expired manufacturing cert
+        (
+            {faultInst_pre_factory: []},
+            False,
+            ssh_cmds({
+                "10.0.0.1": VERIFYAPIC_VALID,
+                "10.0.0.2": VERIFYAPIC_EXPIRED,
+                "10.0.0.3": VERIFYAPIC_VALID,
+            }),
+            "6.1(4a)",
+            fabric_nodes_multi,
+            script.FAIL_O,
+            [
+                ["N/A", "critical",
+                 "APIC 2 (apic2): factory certificate expired on 2024-05-14 20:25:42 UTC"],
+            ],
+        ),
+    ],
+)
+def test_logic(run_check, mock_icurl, mock_conn, cversion, fabric_nodes, expected_result, expected_data):
+    result = run_check(
+        cversion=script.AciVersion(cversion) if cversion else None,
+        username="fake_username",
+        password="fake_password",
+        fabric_nodes=fabric_nodes,
+    )
+    assert result.result == expected_result
+    assert result.data == expected_data
\ No newline at end of file