add new metrics entry for cert expiration

fix #40546 (closed)

I made it return 0 when not using offline master key as to not be confusing when that feature is disabled.