Certificates and Trust

During the handshake the server presents a certificate: a document saying which host it is for, when it expires, and who vouches for it.

Anyone can generate one claiming to be any host, so the signature is what counts. Certificates are signed by a Certificate Authority, and your machine ships with a list of authorities it trusts:

ls -l /etc/ssl/certs/ca-certificates.crt

Your client checks three things: that the certificate is signed by an authority in that list, that it has not expired, and that the name on it matches the host you asked for. Any one failing stops the connection.

That last check is why an internal service reached by its IP often fails even with a valid certificate: the certificate is for a name, and you asked for a number.