We fetch the certificate with SNI, show validity, SANs, TLS version/cipher, and a separate verification attempt.