Not even touching on the fundamentally flawed trust model behind https, here's a sample of recent stories about expired certificates:
https://news.ycombinator.com/item?id=25132182
https://news.ycombinator.com/item?id=24237400
https://news.ycombinator.com/item?id=24187920
https://news.ycombinator.com/item?id=22227266
2. Don't. Your web host should be doing it for you.
My phone and my laptops both seem to correctly notice (via services for the purpose) when there isn't proper Internet access and give me access to some awful Captive Portal to fix that, for which they do not need neverssl.com. This desktop never leaves my home, which doesn't have any such nonsense.
The services they use to do that do involve plaintext HTTP, but importantly they aren't trying to just be something you type into a web browser, and so aren't affected by automatic upgrades of stuff you type into a web browser.
Sunday, thanks to a broken middlebox
2. You sure place a lot of trust into third parties.