SSL and TLS certificates explained
HTTPS uses TLS to encrypt the connection between a client and a server. The certificate is the identity part of that process: it helps the client verify that the server is authorised to present itself for the hostname being visited.
What a certificate contains
A modern website certificate contains a validity period, a public key, information about the issuing certificate authority and a list of hostnames it covers. Those hostnames are normally stored in the Subject Alternative Name, or SAN, extension.
A wildcard such as *.example.com can cover first-level subdomains such as www.example.com, but it does not automatically cover example.com itself or deeper names such as a.b.example.com unless they are separately listed.
The trust chain
Browsers do not simply trust every certificate a server presents. The server certificate is normally signed by an intermediate certificate authority, which ultimately chains back to a root certificate already trusted by the operating system or browser.
During verification, the client checks the signatures, validity dates, hostname and other certificate constraints. A certificate can be unexpired and still fail because the hostname is wrong or the chain cannot be built to a trusted root.
TLS is more than the certificate
The TLS handshake also negotiates a protocol version and cipher suite and establishes the keys used to encrypt the session. That is why a useful TLS check reports more than the certificate dates: the negotiated TLS version, cipher and handshake result provide extra context about the connection.
Inspect a live TLS connection
The certificate checker verifies the hostname and trust chain, then shows the issuer, SANs, validity dates, TLS protocol, cipher and handshake time seen from the IPGetter server.
Where CAA fits in
CAA is a DNS policy that lets a domain say which certificate authorities are permitted to issue certificates for it. CAA does not make an existing certificate trusted or untrusted in the browser. It affects issuance policy at certificate authorities.
If certificate issuance unexpectedly fails, checking CAA can reveal whether the requested certificate authority is authorised for the domain or wildcard name.
What a certificate check cannot tell you
A valid TLS certificate proves control of the hostname according to the certificate authority's validation process and enables an authenticated encrypted connection. It does not prove that the website itself is honest, safe or free from vulnerabilities.
Likewise, security headers such as HSTS and CSP are separate browser controls delivered over HTTP. They complement TLS but solve different problems.
Prefer the command line?
Inspect certificate, issuer, expiry and negotiated TLS details.
> ssl example.com
Run in Terminal ->