Checks a domain’s TLS certificate: whether it covers the hostname, whether the chain validates, how long it stays valid, the key type, the negotiated protocol and cipher, and the certificates the server sends. A browser cannot read a certificate, so the handshake runs through this site’s own diagnostic endpoint — rate limited, and it refuses private or reserved addresses. Nothing about the request is stored.