See when a certificate expires, who issued it, and whether browsers will actually trust it.
How long before expiry should I be warned?
Thirty days is the usual first warning, which leaves room for a renewal to fail quietly and still be fixed. Automated certificates renew around 30 days before expiry, so a certificate inside 14 days usually means automation has already broken.
What does 'not trusted' mean if the certificate is valid?
Validity and trust are different things. A certificate can be within its dates and still be rejected because it is self-signed, because an intermediate certificate is missing from the chain the server sends, or because it was issued for a different hostname. A missing intermediate is the common one: it often works in one browser and fails in another.
I use Let's Encrypt with auto-renewal. Do I still need this?
Auto-renewal is exactly why monitoring matters: when it works you never look at it, so the day it silently stops is the day you find out from customers. Renewal breaks for ordinary reasons — a changed DNS record, a firewall rule, an expired API token, a full disk.