The TLS handshake

A handshake has to do three things before a byte of HTTP flows: authenticate the server (prove the public key in its certificate belongs to the name the client asked for — see Certificates and the Chain of Trust), agree on a shared secret that no observer can derive, and negotiate algorithms (key exchange, signature, symmetric cipher) plus extras such as the application protocol via ALPN (h2, http/1.1) and the hostname via SNI so one IP can serve many certificates. Everything before the shared secret exists is in the clear.

TLS 1.2 takes two round trips. ClientHello (versions, cipher suites, random, SNI, ALPN) → ServerHello + Certificate + ServerKeyExchange (its ephemeral ECDHE public value, signed with the certificate’s key) + ServerHelloDone → ClientKeyExchange (the client’s ECDHE value) + ChangeCipherSpec + Finished → server ChangeCipherSpec + Finished. Both sides derive the same secret from the ECDHE exchange; the Finished messages are MACs over the whole transcript, so any tampering with the negotiation is detected. 1.2 also allowed RSA key exchange (client encrypts a secret to the server’s public key), which has no forward secrecy — compromise the key later, decrypt every recorded session.

TLS 1.3 takes one round trip because the client *guesses*: its ClientHello already carries a key_share for a likely group (usually X25519). The server replies with ServerHello + its own key_share, and from that point everything — EncryptedExtensions, Certificate, CertificateVerify (a signature over the transcript proving possession of the private key), Finished — is already encrypted. The client sends Finished and application data in the same flight. If the guess was wrong the server sends HelloRetryRequest and it costs a second round trip. 1.3 also removed RSA key exchange, static DH, renegotiation, compression and every non-AEAD cipher, so the negotiation surface is small enough that downgrade tricks have little to attack. With a resumption PSK, 1.3 can send 0-RTT data in the first flight — replayable, so only for idempotent requests.

The cost compounds with TCP: one RTT for the handshake (The Three-Way Handshake), plus one (1.3) or two (1.2), so a cold HTTPS request across a 150 ms path spends 300–450 ms before the first HTTP byte. That is why keep-alive, session resumption and TLS termination close to the user matter more than the cipher choice. Failures are legible: an alert such as handshake_failure (no common cipher/version) or protocol_version, a certificate alert after the Certificate message (client rejected it), a hostname mismatch when SNI was missing and the server presented a default certificate, or a silent hang when a middlebox drops something it does not understand. See The TLS Handshake and TLS Debugging: Why the Certificate Is "Invalid".