code: func isExpired(csr *capi.CertificateSigningRequest) (bool, error) {
  	if csr.Status.Certificate == nil {
  		return false, nil
  	}
  	block, _ := pem.Decode(csr.Status.Certificate)
  	if block == nil {
  		return false, fmt.Errorf("expected the certificate associated with the CSR to be PEM encoded")
  	}
  	certs, err := x509.ParseCertificates(block.Bytes)
  	if err != nil {
  		return false, fmt.Errorf("unable to parse certificate data: %v", err)
  	}
  	return time.Now().After(certs[0].NotAfter), nil
  }
docs: // isExpired checks if the CSR has a certificate and the date in the `NotAfter`
  // field has gone by.