Where it is served - a web address is fine, and a port when it isn't 443. Check shows what it serves now; saving a new one checks it.
>
The client's domain it is for. Left blank, it is the domain the host is under.
Matched to the client's domain the host is under when it's saved.
For a host ITFlow can't reach. The issuer, dates, names it covers and fingerprint are read from it - a whole chain is fine, only the first certificate is kept. Never paste the private key.