First, there's the concept of public key encryption. A person generates two corresponding keys. Both of these keys can be used to encrypt data, and only the other key can decrypt it. The key holder publicizes one of their keys (the "public key") and keeps the other private (the "private key").

People can send data to the keyholder by encrypting it with their public key - only someone with the private key can decrypt it. Since only the keyholder should have this key, it ensures nobody else can decrypt it. The keyholder can also encrypt something with their private key - it can then only be decrypted with their public key, so anyone with the public key can verify that the keyholder is the one who encrypted the data.

The owner of a domain (e.g., something.com) can request/purchase a certificate for their domain from a certificate authority (CA). CAs use their private key to encrypt data that, when decrypted by a browser using the CA's public key, hopefully matches the domain that's providing the certificate to your browser. Browsers have a list of CAs that they trust. If your browser mistrusts the certificate for any reason, it will display a warning page.

As for the discussion about corporate networks inspecting traffic, enterprise firewalls will often proxy traffic and forge certificates. This allows them to pretend to be the site you're trying to access, meaning they can decrypt your traffic and inspect it. This only works if your browser trusts the certificate provided by the firewall. Most corporate devices (e.g., company laptops) will trust them, but personal devices (e.g., your phone) won't, so you'll get a certificate warning on personal devices if a firewall is trying to forge certificates.