LoverpingerCheck who is answering.
A certificate connects a hostname to a public key through a chain of trust. A client needs to check the expected hostname, validity period and issuing chain. Ignoring a certificate error also removes an important identity check.
Follow every connection hop.
A public endpoint and its upstream service may use different certificates. A valid public certificate does not prove that the connection to an upstream is being verified. Each encrypted hop needs an appropriate trust configuration.
Renewal is a process, not just a file.
Obtaining a renewed certificate is one step. The service also needs to load it, and the endpoint needs to present it. Verify the certificate served over the actual transport rather than relying only on a file's modification time.
Monitor the certificate clients receive and the renewal job that maintains it. Keep a tested recovery path for failed updates.