Understanding the TLS Handshake: Unlocking the Secrets Behind Your Secure Connection 🔒
When you browse the web, the presence of that little padlock icon 🔒 in your browser’s address bar signifies a secure connection to the website you are visiting. But what exactly happens behind the scenes to establish that connection? In this post, we’ll explore the intricate process known as the TLS (Transport Layer Security) handshake, which is crucial for securing data between you and the server. To aid our understanding, I’ll refer to a helpful infographic that illustrates the message exchanges between your web browser (the client) and the website (the server). Feel free to open this image in a separate tab for reference.
What is the TLS Handshake?
The TLS handshake is a multi-step process designed to achieve two main objectives:
- ✅ Verify the authenticity of the server
- ✅ Establish session keys to safeguard the subsequent data transfer
Before diving into the specifics of the handshake, let’s clarify two essential concepts:
Clarifying Terminology: Records vs. Packets
In the context of the TLS handshake, it’s important to distinguish between “Records” and “Packets.” Each message represented in the accompanying infographic corresponds to a Record. It’s worth noting that multiple Records can be housed within a single Packet, while a single Record may require several Packets to be transmitted.
Cryptographic Foundations
Understanding the TLS handshake also involves some basic knowledge of cryptography. Familiarize yourself with concepts such as:
While I won’t elaborate on these topics here, I encourage you to explore the linked resources if they are new to you.
Now, let’s break down the records that constitute the TLS handshake.
Step 1: Client Hello
The handshake commences with the client sending a Client Hello message comprising five critical fields:
- SSL Version
- Random Number
- Session ID
- Cipher Suites
- Extensions
Each field serves a vital role in the handshake process.
SSL Version
The client relays the highest version of SSL/TLS it supports (e.g., SSL 3.0,
Share this content:
