Every row is a real TLS handshake right now (SNI-correct), cached ~5 min — not the 2026-06-11 audit snapshot. This is why dissemblage.art reads valid here: it self-healed to a Let's Encrypt cert, which the frozen audit never saw.

Name mismatch = the host presents a cert for a different name — almost always a parked subdomain falling through to a box's default_server. A wildcard cert (TLS-STRATEGY option A) makes every one of these valid at once.