I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure.

To my understanding, "secure" here refers to "immune to MITM attacks", but since such websites have certificates and such, is it right to assume they are "clean" and non-malicious?

No, HTTPS does not necessarily mean that a site is not malicious.  HTTPS means very little as to the security of a site.  It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself.  

Yes, a site serving content over HTTPS has a certificate.  That means that the individual who requested the certificate from the CA has an email address that is associated with the domain. Except in the case of Extended Validation certificates (the ones that offer a green address bar) this is literally all it means.  Nobody from the CA is validating that the site is safe, secure, and not serving malware.   Any site, with an SSL cert or without, can have bugs and vulnerabilities that allow an attacker to leverage them to serve an exploit.  Or a admin or user who has the ability to either maliciously or unknowingly cause the site to serve malware. Even if the site itself does not, if it serves advertisements (or any other content, for that matter) from an ad network or another site, that could be vulnerable.

So, HTTPS means that nobody should be able to view or tamper with your traffic.  That is all that it means.  
