The browser lock means a TLS connection was established; it does not mean the site is trustworthy in every other way.
Short answer: inspect Subject Alternative Names (SANs) for host coverage, issuer and chain for trust, validity dates for renewal, and the deployed key/certificate pair for the endpoint actually serving traffic.
| Field | Meaning |
|---|---|
| SAN | DNS names the certificate covers |
| Issuer | Certificate authority that signed it |
| Not Before/After | Validity window |
| Public key | Key clients use in TLS authentication |
The legacy term “SSL certificate” persists, but modern web connections use TLS. Automate renewal and alert well before expiry.
Use openssl s_client or an external monitor to check the live chain, not just the file your deployment intended to install.
Cover photo by Stanislav Kondratiev on Pexels.