The Badfish page at https://filippo.io/Badfish/ seems to be down. Any other place where I can direct people to check for invalid security certificates?
I have not looked for an online tool, but you can download sigcheck [1] and run `sigcheck -tv` which will display "valid certificates not rooted to the Microsoft Certificate Trust List".