The SAFCRRPT Utility, when run with EDAYS(90), is not showing expired certificates.
Add 'USER(-)' or 'RECORDID(-)' to the SAFCRRPT report parameters.
Specify USER or RECORDID, but not both, in order to avoid ambiguity. If both parameters are specified, then the SAFCRRPT uses the LAST one specified in the input parameters.