TLS handshake

The client opens with the versions and cipher suites it supports, a random value, and — through Server Name Indication — the hostname it wants, which is what lets one address serve many sites.

The server replies with its choice of version and suite, its own random value, and its certificate chain.

The client validates the chain against its trust store and checks that the certificate covers the requested hostname.

Both sides derive the session keys from the exchanged key material, and the connection switches to encrypted records.

In TLS 1.3 the server's part of this is folded into a single flight, which is where the saved round trip comes from.

A full TLS 1.3 handshake adds one round trip on top of the TCP handshake. TLS 1.2 adds two.

On a connection with 100 ms of latency that is the difference between roughly 100 ms and 200 ms before the request is even sent.

Session resumption removes most of it for returning connections, and TLS 1.3 offers a zero-round-trip mode for resumed sessions with a replay trade-off that makes it unsuitable for non-idempotent requests.

Connection reuse matters more than any of this: a page that opens one connection and sends fifty requests pays the handshake once.

They happen before HTTP, so there is no status code. The browser shows a connection or security error rather than a page.

A version mismatch — a server that only offers TLS 1.0 to a modern browser — produces a protocol error.

A certificate problem produces a warning naming the reason: expired, hostname mismatch, or an issuer the client does not trust.

An incomplete chain produces a trust failure on some clients and works on others, which is the confusing case.

Because there is no HTTP exchange, server access logs may contain nothing at all, and the fault has to be diagnosed from the client side.

`openssl s_client -connect example.com:443 -servername example.com` prints each step, the negotiated parameters and the chain.

`curl -v https://example.com` shows the handshake summary followed by the HTTP exchange, which makes the boundary between the two clear.

`curl -w "%{time_appconnect}\n" -o /dev/null -s https://example.com` reports the moment the handshake completed, separating TLS cost from server time.

Omitting `-servername` tests what a client without Server Name Indication receives, which is how you find a default certificate that covers the wrong site.