Valida certificado, SANs, confiança (CA bundle) e revogação (OCSP + fallback CA Issuers).
Enhanced v2.0 — Rate limiting, caching, improved security