An SSL (TLS) certificate is a signed assertion that "this public key belongs to this hostname." Browsers trust it because it's signed by a certificate authority they already trust. Open any cert and you'll see a dozen fields; most don't matter to users, two do.
The fields that matter
- Subject (CN + SANs). Who the cert is for. The Common Name + every Subject Alternative Name. Wildcard SAN (
*.example.com) covers any direct subdomain. - Validity. Two timestamps. Browsers reject expired certs hard.
- Issuer. The CA that signed it. Modern browsers trust ~150 CAs by default; anything outside that root store is treated as a self-signed cert.
- Signature algorithm. Anything with SHA1 has been rejected since 2017. Modern certs use SHA-256 with ECDSA or RSA.
Inspecting any site
Our SSL Certificate Checker performs a real TLS handshake against any host, extracts the cert, and reports all of the above plus how many days are left before expiry.