You may also want to look at https://github.com/digicert/pkilint

There are other similar tools (cablint, x509lint, zlint), but there's been a lot of good talk about pkilint recently.