Does it check the whole certificate chain or just the leaf?
The handshake validates the full chain against a standard trust store, so a missing intermediate or an untrusted root is reported. The details shown describe the leaf certificate the server presented
Why does it show a SHA-1 fingerprint rather than SHA-256?
SHA-1 is the fingerprint the underlying runtime reports for the presented certificate. It is labelled honestly rather than presented as a SHA-256 digest it is not. Use it to confirm which certificate is deployed, not as a security control
Can it check a certificate on a port other than 443?
No. The check connects over HTTPS on the default port. A service on another port needs a request you can configure, which is what the REST API Client is for
Can it check an internal or localhost host?
No. The connection is made by Postman rather than by your browser, so it can only reach hosts that are publicly resolvable
Will it warn me before the certificate expires?
Not on its own. This is a single check run when you ask for it. Repeated checks on a schedule with alerting are what Postman monitors are for