An expiration warning isn't usually what you'd see if somebody was trying to do something malicious, but rather a CN mismatch and/or not-signed-by-recognized-CA

An expiration warning isn't usually what you'd see if somebody was trying to do something malicious, but rather a CN mismatch and/or not-signed-by-recognized-CA error -- but yes, difficult for "the consumer" to distinguish. It's up to the site administrator to make sure their SSL is valid and configured properly. A certificate doesn't "just expire".