[AdamMagued]

Problem

When checking a TLS endpoint whose certificate has already expired, tls.DialWithDialer returns an x509.CertificateInvalidError (with reason x509.Expired) during the TLS handshake. As a result:

1. conns[i] remains nil.
2. checks[i].Error records the dial error string.
3. In conclude(), the generic error check triggers first and returns immediately before inspecting peer certificates on the connection.

Solution

• In Checker.doChecks(), unwrap connection dial errors using errors.As(err, &certErr).
• When certErr.Reason == x509.Expired and certErr.Cert != nil, extract certErr.Cert.NotAfter and format checks[i].Error with the duration since expiration.
• Add unit tests in check/tls/tls_test.go verifying that endpoints with expired certificates report Down = true and include the expiration duration in the attempt error output.

Fixes #147