A kubeadm-managed control plane reports errors consistent with expired certificates. Which command directly lists the expiration of certificates managed locally by kubeadm?

1. kubectl rollout restart deployment -A
2. kubectl get resourcequota -A
3. kubeadm reset
4. kubeadm certs check-expiration