When using SSL authentication, what does the client verify first when checking a server's identity?

The certificate must be non$-$expiring and self$-$signed by the sysadmin.

All DNS resolutions must point to the corporate intranet routers.

The current date and time must fall within the server's certificate$-$validity period.

Master secrets are verifiable from asymmetric keys.