TLS certificate inspection
Connects to port 443 with certificate-chain and hostname verification enabled.
The connection validates both the trust chain and hostname
The PHP TLS context keeps peer verification and peer-name verification enabled. A certificate signed by a trusted CA is therefore not enough: its identity must also match the hostname requested by the user.
Subject Alternative Names are the primary identities to inspect
Modern certificates normally carry DNS identities in the Subject Alternative Name extension. A certificate can cover several names and wildcards, so the Common Name alone is not a complete representation of its hostname coverage.
The destination is pinned to a validated public IP
Before TLS starts, the page resolves every A and AAAA record and rejects the hostname if any address is private or reserved. The socket is then opened directly to one validated literal IP, while SNI and hostname validation keep using the original hostname.
Protocol and cipher describe this specific handshake
The protocol and cipher displayed are those negotiated between this portal server and the destination during this connection. They do not enumerate every TLS version or cipher suite supported by the remote service.
A valid certificate is only one layer of web security
A valid TLS certificate does not prove that an application is secure. Protocol policy, cipher configuration, HSTS, certificate lifecycle, HTTP security headers and application vulnerabilities remain separate concerns.