Every HTTPS connection begins with a TLS handshake — a negotiation that establishes encryption and verifies the server’s identity before a single byte of your actual request is sent.
The Handshake, Step by Step
- Client Hello — the browser announces supported TLS versions and cipher suites
- Server Hello — the server picks a cipher suite and sends its certificate (proving its identity, signed by a trusted Certificate Authority)
- Key exchange — client and server derive a shared secret key, using asymmetric cryptography, without ever transmitting the key itself over the network
- Finished — both sides confirm the handshake, then switch to fast symmetric encryption for the actual data transfer
Why Two Types of Cryptography
Asymmetric (public/private key): used ONLY during the handshake to
securely establish a shared secret - computationally expensive
Symmetric (shared secret key): used for the ACTUAL data transfer
after the handshake - dramatically faster
Asymmetric cryptography is too computationally expensive to use for an entire session’s worth of data — TLS uses it briefly, just to safely establish a shared symmetric key, then switches to fast symmetric encryption for everything else. This hybrid approach is exactly what makes HTTPS both secure and fast enough for everyday use.
TLS 1.3’s Improvement
TLS 1.3 (2018) reduced the handshake to effectively one round-trip instead of two, genuinely cutting connection setup latency — a meaningful, measurable improvement given how many new connections a typical web page establishes.