Live TLS Handshake
The tool opens a real TLS connection to your domain on port 443, captures the peer certificate during the handshake, and parses it via OpenSSL. So you see the actual certificate the server presents, not a cached database lookup that may be days out of date.