What is checked
A monitoring location connects to the server and checks the certificate like a browser against the usual root certificates: if it has expired, does not match the name or an intermediate certificate is missing, we show the reason. Plus issuer, validity, alternative names (SAN), key type, TLS version and the chain the server sends.
The most common error after a renewal is an incomplete chain: the browser on your own computer still knows the intermediate certificate and shows nothing, other devices refuse the connection.