How can I monitor openvpn certificate expiration in icinga?

Question

openvpn

There is a monitoring server with icinga2 (nagios). There is also a virtual machine with openvpn.
How can I tie (1) monitoring the expiration of the ovpn certificate in icinga, so that I don’t “miss the moment” and (2_ monitoring the open port of the tunnel (listening to it from the service side)?
For the first, third-party plugins will obviously be needed? Are there any?