Paste in a PEM-format SSL certificate and a wall of fields shows up โ here's what each one means.
Subject, CN, and SAN
Domains used to go into a single Common Name (CN), but modern browsers ignore CN entirely and only check the list of domains in the Subject Alternative Name (SAN) field. A wildcard covering multiple subdomains (*.example.com) also shows up in SAN.
Issuer and the certificate chain
The issuer is the certificate authority (CA) that signed this certificate. A browser follows the chain from this certificate to an intermediate CA certificate to a root CA certificate, and trusts it only if that root is in its own trust store.
Validity period and checking expiry
Not Before and Not After mark the start and end of validity. Certificates from public CAs today are usually short-lived (90 days to a year), which makes automated renewal (like Let's Encrypt's certbot) essential.