Expiring SSL Cert Query for Specific CA

If anyone is looking, the correct fields are:

ssl.cert.serial.number

ssl.cert.sha1.fingerprint