Find which of the four it is
It is self-signed
Someone generated it locally rather than obtaining one from a certificate authority. Common on servers that were set up for testing and then ended up live. Replace it with a real certificate, which is free from Let's Encrypt and takes minutes.
It does not cover this name
The certificate is valid but was issued for a different hostname. Usually the www version exists and the bare domain does not, or the other way round. Reissue covering both, or redirect one to the other before the certificate is presented.
It has expired
The most common cause, and the one with a deadline attached. See the expiry guide.
The chain is broken
Valid certificate, missing intermediate. This one is the deceptive case because it works for you. See the chain guide.
What not to do
Do not tell customers to click through the warning. Beyond the obvious, it trains people to dismiss exactly the warning that protects them, and it will be a problem again when the cause is real.
On chains specifically: the certificate chains field guide.