The padlock in the browser says only that something verified. This opens a TLS connection to the host from this server, with the host name as SNI, and reads the certificate, its chain and validity, the key, the negotiated protocol and cipher, and then tries TLS 1.0, 1.1, 1.2 and 1.3 one by one to see which the server accepts. No HTTP request is sent.
Up to six TLS handshakes are opened from this server to the host entered, none of them followed by an HTTP request. Hosts in private, loopback and link-local networks are refused. The query is protected by reCAPTCHA v3; the calling IP address and the target are stored for one hour to limit the rate.
Limits worth knowing: only one of the resolved addresses is tested, which matters behind a load balancer with differing certificates; OCSP stapling and certificate transparency are not read; whether TLS 1.0 and 1.1 are accepted can only be judged when this server's own OpenSSL still speaks them, otherwise they show as not measurable.