Open a live TLS connection to a host and return its certificate. Give a host (and optional port, default 443). Returns the negotiated TLS protocol + cipher, whether the chain validates against system roots, and the leaf certificate's subject + issuer (CN/O/C), validity window (valid-from / valid-to), days until expiry + expired flag, serial number, SHA-256 fingerprint, Subject Alternative Names, and the chain length. A genuine network probe agents can't do from their sandbox — for cert-expiry monitoring, TLS audits, and verifying who issued a site's certificate. SSRF-guarded: the host must resolve to a public address. Self-signed and expired certs are reported (not rejected).