A certificate ties a domain name to a public key and is signed by a certificate authority that browsers already trust. When a visitor connects, your server presents the certificate, the browser checks the signature, the domain name and the dates, and only then continues. If any check fails, the visitor sees a full-page warning instead of your app.
Certificates are issued after the authority confirms that you control the domain, usually automatically through a DNS record or a file served from your site. Free authorities such as Let's Encrypt issue them at no cost, and most hosts request and renew them for you, so paying for a basic certificate is rarely necessary.
The failures are mostly operational. A certificate expires because automatic renewal quietly broke, a new subdomain is not covered by the existing certificate, or a server sends an incomplete chain that works in some browsers and not in others. A valid certificate proves who controls the domain and that the connection is encrypted. It says nothing about whether the site behind it is safe.