def identify_and_persist_expiring_deployed_certificates(exclude_domains, exclude_owners, commit,
                                                        timeout_seconds_per_network_call=1):
    """
    Finds all certificates expiring soon but are still being used for TLS at any domain with which they are associated.
    Identified ports will then be persisted on the certificate_associations row for the given cert/domain combo.

    Note that this makes actual TLS network calls in order to establish the "deployed" part of this check.
    """
    all_certs = defaultdict(dict)
    for c in get_certs_for_expiring_deployed_cert_check(exclude_domains, exclude_owners):
        domains_for_cert = find_and_persist_domains_where_cert_is_deployed(c, exclude_domains, commit,
                                                                           timeout_seconds_per_network_call)
        if len(domains_for_cert) > 0:
            all_certs[c] = domains_for_cert

    Finds all certificates expiring soon but are still being used for TLS at any domain with which they are associated.
    Identified ports will then be persisted on the certificate_associations row for the given cert/domain combo.

    Note that this makes actual TLS network calls in order to establish the "deployed" part of this check.
    
lemur/certificates/service.py