TLS Handshake Step-by-Step
When a client opens an https:// URL, it cannot send an ordinary HTTP request immediately. The client and server first need to agree on cryptographic parameters, establish fresh shared secrets, and authenticate the server. That setup conversation is the TLS handshake.
The handshake has four closely related jobs:
- Negotiate a TLS version and compatible algorithms
- Establish secrets that a passive observer cannot calculate
- Authenticate the server and, when requested, the client
- Bind the entire negotiation together so that tampering is detected
Afterward, the TLS record layer uses the resulting traffic keys to protect HTTP messages. TLS provides confidentiality, integrity, and peer authentication; HTTP continues to define methods, fields, status codes, and content.
This chapter follows TLS 1.3, the normal modern handshake for HTTPS. TLS 1.2 is still encountered, but its message order and algorithm negotiation differ. A short comparison later in the chapter makes those differences explicit.