A simplified account of what happens when a visitor loads a secure page.
THE SEQUENCE
- The browser connects to the server and says which hostname it wants.
- The server presents its certificate for that hostname.
- The browser checks the certificate: is it issued by an authority the browser trusts, is it still valid, and does it cover this hostname?
- If all three pass, browser and server agree on encryption keys for this session.
- All subsequent traffic is encrypted with those keys.
WHY THE CHECKS MATTER
Each one prevents a specific attack. An untrusted issuer means anyone could mint a certificate for your domain. An expired certificate may have been compromised since issue. A hostname mismatch means someone is presenting a certificate they hold for a different site.
WHEN A CHECK FAILS
The browser shows a warning rather than loading the page. Visitors almost always leave rather than clicking through.
WHAT THIS MEANS PRACTICALLY
Certificate problems are not cosmetic. A failed check blocks the site entirely for most visitors.
