Scan hosts for TLS certificate compliance — detect expired certs, weak ciphers, self-signed chains, and deprecated protocols