def get_certificates_for_security_summary_email(exclude=None):
    """
    Finds all certificates that are eligible for expiration notifications for the security expiration summary.
    :param exclude:
    :return:
    """
    now = arrow.utcnow()
    threshold_days = current_app.config.get("LEMUR_EXPIRATION_SUMMARY_EMAIL_THRESHOLD_DAYS", 14)
    max_not_after = now + timedelta(days=threshold_days + 1)

    q = (
        database.db.session.query(Certificate)
        .filter(Certificate.not_after <= max_not_after)
        .filter(Certificate.notify == true())
        .filter(Certificate.expired == false())
        .filter(Certificate.revoked == false())
    )

    exclude_conditions = []
    if exclude:
        for e in exclude:
            exclude_conditions.append(~Certificate.name.ilike(f"%{e}%"))

        q = q.filter(and_(*exclude_conditions))

    certs = []
    for c in windowed_query(q, Certificate.id, 10000):
        days_remaining = (c.not_after - now).days
        if days_remaining <= threshold_days:
            certs.append(c)
    return certs

    Finds all certificates that are eligible for expiration notifications for the security expiration summary.
    :param exclude:
    :return:
    
lemur/notifications/messaging.py