What Happens During a TLS Handshake?

Every HTTPS connection opens with a handshake that has three jobs: agree on a shared symmetric key, confirm the server's identity, and settle which cryptography both sides will use. It has to finish in milliseconds, over a network where every packet is readable.

TLS 1.3 does this in a single round trip. The trick is that the client's ClientHello includes a key_share guessing which curve group the server will choose, so once ServerHello returns the server's share, both sides can already derive the secret — which is why the certificate and identity proof that follow are encrypted, unlike in TLS 1.2. ECDHE is what produces that shared secret without it ever crossing the wire, and because the keypairs are ephemeral you get forward secrecy: stealing the server's long-term key next year won't decrypt traffic recorded today. TLS 1.3 removed static RSA key transport entirely, along with renegotiation, compression, and CBC-mode ciphers.

Resumption skips the key exchange, and 0-RTT skips the wait completely, but 0-RTT data is replayable so it belongs only on idempotent requests.