Marco Amrein sent me a StartTLS patch for ssl-cert-check this week. This nifty patch allows ssl-cert-check to query servers that setup the TLS connection after the initial protocol handshake, which can be helpful for checking the certificate expiration on SMTP and POP3 servers:
$ ssl-cert-check -s mail.prefetch.net -p 25
Host Status Expires Days Left
----------------------------------------------- ------------ ------------ ----------
mail.prefetch.net:25 Valid Jun 20 2006 179
Thanks Marco!