Recently Windows Azure Storage SSL certificate unexpectedly expired and since a lot of dependent services defaulted to "refuse to connect to a site with expired SSL certificate" that became a serious problem.
Now the SSL certificate of any web service can be retrieved by anyone at any time for validation. The picture is from the linked to question:
So it means that the information was available at all times to "anyone it might concern" and any user of the service could have noticed the upcoming expiration and for example post a message on Microsoft forums before it was too late.
However I can't find any information about how such cases are typically handled except this question for doing that in code.
Is there any kind of best practice for validating third party services SSL certificates? What tools are typically used?