My bank's website, while always having had a 'green lock' in the address bar doesn't have this anymore. I then called the bank with a phone number I found on the same website, and asked that the operator read the serial number of the certificate to me. She refused to do this and insisted I would read the serial number to her, and she would verify her.
I denied this and explained her that I cannot trust her telephone number. While having her read the serial number doesn't give me much security (after all, if I'm talking to a hacker, she would read to me the serial number of the invalid certificate), I didn't feel comfortable reading the serial number to her - it makes it to easy to just say "Yeah, that's correct".
I don't know why she refused to give me the serial number (does she really think this is sensitive information? I hope not. More likely, they trained her to not give "too much" information.)
But this made me thinking. What should I do in case the certificate of my bank's website shows as weak, invalid, expired, ...?
Note: I'm extra cautious today as this is the second bank website I'm visiting today which doesn't have a green lock. The other one even had a red cross. I don't know if my browser / computer is compromised or that it's just Chromium being more reluctant to accept SHA-1 signatures. When I phoned the other bank, he didn't even want to verify the serial number with me, and after that it took me ten minutes to convince him to make a note about the certificate for his superiors, which I'm quite sure he won't do. What a world we live in.