What a website can and cannot see
Page scripts cannot read the browser's TLS session. They can read the protocol your browser used (HTTP/2 or HTTP/3) and how long the handshake took. The TLS version and cipher are known to the web server that terminated the connection, and are shown here when that server passes them on.
The certificate details come from this site's own check of its server: the same certificate your browser received, unless a network you are on (a company firewall, some antivirus software) replaced it. Compare the SHA-256 fingerprint with the one your browser shows under the padlock to rule that out.
What good looks like
- TLS 1.3, or TLS 1.2 with an ECDHE key exchange and an AES-GCM or ChaCha20 cipher.
- A certificate from a public authority with weeks or months left.
- HSTS with a max-age of at least six months.
- HTTP/2 or HTTP/3.
Questions
- Why does my browser show a different fingerprint?
- Something between you and this site is decrypting your traffic: usually a workplace security gateway or antivirus web filtering with its own root certificate. Anyone else doing it would be a reason for concern.