It's the file a website shows your browser to prove it really is that site. A certificate authority (CA) signs it after checking that the owner controls the domain, and your browser trusts a short list of root CAs. "SSL" is the old name; today's connections use TLS.
*.example.com covers one level only, and not example.com itself.TLS 1.3 (2018) is the current version, faster and simpler. TLS 1.2 is still fine. TLS 1.0 and 1.1 were retired by browsers in 2020, and SSL 3.0 is broken.
No letter grades. Errors mean browsers or common clients will fail or the connection is unsafe (expired, wrong name, untrusted, incomplete chain, revoked, broken ciphers). Warnings are real weaknesses that still connect (old TLS versions, 3DES, no HTTPS redirect, expiring within 14 days). Info is worth knowing. "Not tested" means exactly that; we don't send exploit probes.
The hostname goes to cert.gripe's server (a Cloudflare Worker). It looks the name up with Cloudflare's DNS-over-HTTPS resolver, then connects to the site itself: a few dozen short TLS handshakes that stop after the server's first reply, plus ordinary HTTP requests. It asks the certificate's CA for OCSP, CRL and missing intermediates, and only when you ask, crt.sh for Certificate Transparency history. Those see our server, not you. Results are cached for 5 minutes; your recent checks stay in your browser. Sites on Cloudflare's own network can't be reached by raw connections from a Worker, so for them we show only what HTTP and CT can tell. Roots: Mozilla's store via certifi.