A certificate is only as trustworthy as the path from it to a trust anchor the verifier already has. Verifying it means checking the issuer's signature, the validity window, the name the client actually wanted (the subjectAltName for TLS), the allowed usages, the revocation status and every certificate up to a trusted root (RFC 5280 §6).
Publicly trusted TLS certificates are issued under the CA/Browser Forum Baseline Requirements: the issuing CA validates control of each domain, logs the certificate to Certificate Transparency and limits its lifetime. Under ballot SC-081v3 the maximum lifetime fell from 398 to 200 days for certificates issued from 15 March 2026, and it drops to 100 days from 15 March 2027 and 47 days from 15 March 2029.
Other certificate formats exist: OpenSSH certificates (a simpler signed key format), OpenPGP keys signed by other keys, the card-verifiable certificates of ePassports and the Merkle Tree Certificates being designed for post-quantum TLS. "Certificate" alone in a TLS or browser context means X.509.