Every site with https:// in the address bar has an SSL/TLS certificate behind it, and most people know just enough about them to feel reassured by the padlock icon. That reassurance is only partly earned. A certificate proves something specific and narrow -- not that a site is safe, honest, or who it claims to be in any broad sense.
What a certificate actually proves
An SSL/TLS certificate does two things: it encrypts the connection between your browser and the server, and it confirms that the server responding is actually the one controlling the domain in the address bar. That's it. It says nothing about the content on the page, whether the business behind it is real, or whether the checkout form is going to charge your card correctly. Plenty of phishing sites have valid certificates -- getting one for a domain you control is fast and often free.
The chain of trust, briefly
Certificates aren't self-declared. They're issued by a Certificate Authority (CA) that your browser already trusts, and that trust is chained: the CA signs the site's certificate, and a root authority (baked into your OS or browser) vouches for the CA. If any link in that chain is broken -- an expired root, an untrusted intermediate, a mismatched domain -- your browser throws a warning instead of showing the padlock quietly.
Expiry dates matter more than people think
Certificates aren't permanent. Most last 90 days to a year, and when one lapses, visitors get a hard browser warning, not a soft degradation. This catches out businesses constantly -- a site that worked fine yesterday suddenly looks broken because nobody renewed the cert in time. If you run a site, checking expiry isn't a one-time task, it's something worth revisiting periodically, especially if renewal isn't fully automated.
The padlock isn't a safety rating
It's worth repeating because the misconception is so common: HTTPS tells you the connection is private, not that the destination is legitimate. Before you trust a site with sensitive information, the certificate is one small signal among many -- domain age, how you arrived there, whether the URL matches what you expected. Don't let a padlock substitute for actually looking at the address bar.
Check any certificate in seconds
If you want to see who issued a site's certificate, when it expires, and whether it actually covers the domain (and subdomains) you're looking at, you don't need command-line tools for it. The SSL Certificate Checker looks up a domain's certificate details directly -- issuer, expiry, and coverage -- so you can confirm a cert is valid and see exactly how much runway is left before it needs renewing.