SSL/TLS Handshake: How It Works Step by Step

What the Handshake Does

The handshake has three jobs: the browser and server agree on the protocol version and encryption methods, the browser checks that the server is really the website it claims to be, and both sides create the keys that will encrypt the rest of the connection. It takes a fraction of a second and happens every time a new HTTPS connection opens.

The TLS 1.3 Handshake Step by Step

TLS 1.3 is the current version of the protocol and is used by most websites today. Its handshake has four steps:

1. ClientHello. The browser sends the TLS versions and encryption methods it supports, the website name it wants to reach, and its part of a temporary key exchange.
2. ServerHello. The server picks the encryption method and sends its own part of the key exchange. From these two parts, the browser and server each calculate the same shared secret without ever sending it. Everything after this point is encrypted.
3. Certificate and verification. The server sends its SSL certificate together with the intermediate certificates, and signs the handshake with its private key. The browser checks that the certificate is valid, matches the website name, and leads back to a trusted root certificate, and that the signature is correct.
4. Finished. Both sides send a Finished message confirming that nobody changed the handshake along the way. The browser can start sending data right away.

When a visitor returns to a website they've connected to recently, TLS 1.3 can resume the earlier session and skip part of the handshake, which makes repeat connections even faster.

For more on the encryption behind these steps, see Symmetric vs. Asymmetric Encryption: What's the Difference? .

How TLS 1.3 Differs from TLS 1.2

• It's faster. TLS 1.3 needs one round trip between browser and server before data can flow. TLS 1.2 needs two.
• RSA key exchange is gone. In TLS 1.2, the browser could encrypt a secret with the certificate's public key and send it to the server. TLS 1.3 removed this method. Every connection now gets its own temporary keys, so recorded traffic stays safe even if the server's private key is stolen later.
• Weak options are removed. Outdated algorithms that TLS 1.2 still allowed, such as RC4 and SHA-1, can't be used in TLS 1.3.
• More of the handshake is encrypted, including the server's certificate.

TLS 1.2 is still widely supported and safe when configured well. TLS 1.0 and 1.1 are outdated and no longer supported by modern browsers.

Where Your SSL Certificate Fits In

Your SSL certificate's role in the handshake is to prove the server's identity. For this to work, the server must send not only your certificate but also the intermediate certificates that link it to a trusted root. Most handshake problems on newly installed certificates come from a missing intermediate certificate.

If several websites share one server, the server uses the website name from the ClientHello, a feature called SNI (Server Name Indication), to choose the right certificate.

Common Handshake Errors and How to Fix Them

The error codes below are the ones shown by Chrome and Edge. Firefox and Safari describe the same problems in different words, but the causes and fixes are the same.

• NET::ERR_CERT_DATE_INVALID. The certificate has expired or isn't valid yet. Renew the certificate, or check the date and time on the visitor's computer if only one person sees the error.
• NET::ERR_CERT_COMMON_NAME_INVALID. The certificate doesn't cover the website name the visitor typed, for example www.example.com instead of example.com. Make sure the certificate includes every name the site is reached by.
• NET::ERR_CERT_AUTHORITY_INVALID. The browser can't link the certificate to a trusted root, usually because intermediate certificates aren't installed. Install the full CA bundle on the server. See Windows Does Not Have Enough Information to Verify This Certificate .
• ERR_SSL_VERSION_OR_CIPHER_MISMATCH. The browser and server have no TLS version or encryption method in common, often because the server allows only outdated settings. Enable TLS 1.2 and TLS 1.3 on the server.

openssl s_client -connect example.com:443 -servername example.com