In more detail
Website certificates (X.509) list the domain names they cover, the issuer, the validity dates and the public key, and are signed by a certificate authority that browsers trust, often through a chain of intermediate certificates. Expired, mismatched or untrusted certificates trigger browser warnings. The names that count are in the Subject Alternative Name (SAN) extension; a wildcard such as *.example.com covers one level of subdomain only. The certificate itself is public: the matching private key stays on the server and proves possession during the TLS handshake.
Why it matters
Most HTTPS outages are certificate problems: a renewal that did not run, a missing intermediate on the server, or a name not listed in the SAN. Public certificate lifetimes are also being shortened in stages under CA/Browser Forum rules, so automated renewal (for example with ACME clients) is no longer optional for most sites.
Example
Inspecting a certificate with OpenSSL (a self-signed test certificate made for this page):
$ openssl x509 -in srv.crt -noout -subject -issuer -dates -ext subjectAltName
subject=CN=www.example.com
issuer=CN=www.example.com
notBefore=Oct 10 04:34:50 2026 GMT
notAfter=Jan 8 04:34:50 2027 GMT
X509v3 Subject Alternative Name:
DNS:www.example.com, DNS:example.com
Subject equal to issuer means it is self-signed, so browsers will not trust it. Check a live site with the SSL Certificate Checker or paste a PEM into the Certificate Decoder.