Why the browser shows a warning
Three reasons cover almost every case: the certificate has expired, the chain the server sends is incomplete, or the host name being opened is not in the certificate. The last one happens when the certificate was issued for example.com and the site is opened as www.example.com. Browsers match the address against the subjectAltName list, so a name that appears only in the common name field does not count.
An incomplete chain is the deceptive one. A desktop with a recent operating system may open the site without complaint because it already holds the intermediate certificate, while an older phone or a curl call refuses it. The server has to send its own certificate together with every intermediate above it, and only the root may be left out.
Expiry and renewal
Certificate lifetimes keep getting shorter, so renewal has to be automatic. If a certificate is still renewed by hand, set the reminder at least 20 days before the expiry date, and remember that installing the file is not the last step: the service has to be reloaded before it serves the new certificate.