One entry per certificate name (lineage): the certificate the servers using that name should have now, the names it covers, when it expires and how many days are left. The issuing node publishes each renewal here and the servers pick it up from here; sha256_fullchain is what each of them compares with its own copy to tell whether it is out of date. No key material is ever included.
Good to know
Only the current certificate for each name is listed, not older ones.
published_by is the issuing node's agent, and promoted_at is when this certificate became the current one.
days_remaining counts whole days, and goes below 0 once a certificate is more than a day past its expiry.
