In what ways can a certificate become invalid before or at the end of its life?

It expires at its "not after" date, or the CA revokes it early and publishes that in a CRL or through an OCSP responder.

• Expiry. Every certificate carries a validity period. After not after it is invalid without anyone doing anything. Short lifetimes limit the damage of a key nobody noticed was stolen.
• Revocation by the CA, for reasons such as a stolen or leaked private key, an employee leaving, a changed name or e-mail address, a certificate issued by mistake, or a compromised CA. Revocation has to be published so verifiers learn about it:
  • Certificate Revocation List (CRL): a list of revoked serial numbers, signed by the CA and downloaded by clients from the CRL Distribution Point named in the certificate. Delta CRLs carry only the changes since the last full list.
  • OCSP (Online Certificate Status Protocol): the verifier asks a responder about one specific certificate and gets back a signed "good / revoked / unknown".
  • OCSP stapling: the server fetches its own fresh OCSP response and hands it to clients during the TLS handshake, so clients don't have to query the CA themselves.
• Distrusting the issuer. If a CA is compromised, browsers and operating systems remove its root from their trust stores, and every certificate below it stops validating at once (what happened to DigiNotar in 2011).

The hard part is not declaring a certificate invalid but making every verifier notice in time, which is why the location of the CRL and OCSP service is written into the certificate itself.

Go deeper:

• Wikipedia: Certificate revocation list — reasons, delta CRLs and the known weaknesses.
• Wikipedia: OCSP stapling — why the server, not the client, should fetch the status.