Skip to content

What a TLS handshake actually does

Level: 301 · working knowledge

Stub — an outline, not a lesson. There is no runnable example behind this page yet, so nothing on it has been through the check that backs every other claim in this library. The bullets below are the questions the finished page has to answer.

One line: Every primitive in this library, in one exchange, in a fixed order — watched live with openssl s_client.

The questions this page has to answer

  • What are the three jobs of a handshake, and which primitive does each?
  • Watch a real one: openssl s_client -connect … -tls1_3 and read the transcript.
  • Where does the certificate come in, what does it actually assert, and who is vouching?
  • Why is the bulk data symmetric, and where did that key come from?
  • What changed in TLS 1.3, and which whole category of attack it deleted.

See also