echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer

-subject prints the certificate owner's distinguished name, and -issuer prints the CA (certificate authority) that signed it, so you can confirm the cert matches the domain and comes from an expected issuer. -servername sends SNI (server name indication), which matters when one IP hosts many sites.