TLS handshake in detail

In short: In the TLS handshake browser and server agree on encryption, check the server’s certificate and create shared session keys that an eavesdropper cannot derive.

In more detail: In TLS 1.3 the client’s first message (ClientHello) carries supported methods and a key share (Diffie-Hellman). The server answers with its share, its certificate and a signature. Both compute the same key from it. After just one round trip the connection is encrypted.

In Depth

• Certificate: Binds a domain to a public key, signed by a certificate authority (CA). The browser checks chain, validity and names.
• Key exchange: (EC)DHE provides forward secrecy: stolen long-term keys do not decrypt old recordings.
• AEAD encryption: AES-GCM or ChaCha20-Poly1305 encrypt and authenticate at once.
• SNI: The host name in the ClientHello (ECH hides it).
• Session resumption/0-RTT: Faster reconnection.
• TLS 1.2 vs. 1.3: 1.3 drops insecure methods, is faster.
• Certificate transparency: Public logs make wrongly issued certificates visible.

See also: Diffie-Hellman and forward secrecy, Authenticated encryption (AEAD)