Check a site's certificate: expiry, whether it covers the name, and whether the chain is complete.
Expiry is the obvious one, and still the most common outage. Automated renewal fails quietly far more often than people expect, so the useful question is not how long is left but whether renewal is actually working.
A name mismatch means the certificate is valid but does not cover the name being visited. Browsers refuse it outright, and it usually means the wrong virtual host answered rather than that anything is wrong with the certificate.
An incomplete chain is the one that wastes the most time. If the server does not send the intermediate certificates, some clients complete the chain from a cached copy and others do not, so the site works perfectly for you and fails for a customer on a different device. It is intermittent by nature and very hard to reproduce from the inside.
Almost always a missing intermediate. Your browser has one cached from another site; theirs does not. Serve the full chain your CA gave you.
Enough to notice a failed renewal and act, which in practice means at least a fortnight, and an alert that reaches a person rather than a mailbox nobody reads.