Automatic renewal has made expired certificates rarer, which makes them more surprising when they happen. A renewal job fails, a DNS change breaks validation, and a perfectly healthy service starts showing browser warnings to everyone.
Warn early, then warn louder
Alert well before the expiry date, with enough time to fix renewal by hand if you have to. Three weeks out is a good first warning; a week out should reach the person on call.
Check what visitors see
Watch the certificate served on the public hostname, not the file on disk. Load balancers, CDNs and proxies each hold their own copy, and the one that expires is rarely the one you were looking at.