# What Is TLS Handshake? Definition and Examples

> The TLS handshake is the opening exchange of a TLS connection, in which client and server agree on version and cipher, authenticate the server and derive keys.

Source: https://ssl.sh/glossary/tls-handshake/
Last updated: 2026-11-10

The TLS handshake is the set of messages exchanged before any application data is protected. The client's ClientHello lists supported versions, [cipher suites](https://ssl.sh/glossary/cipher-suite/), key shares and extensions such as [SNI](https://ssl.sh/glossary/sni/) and ALPN. The server picks the parameters, sends its certificate chain and proves it holds the matching private key by signing the handshake transcript. Both sides then derive symmetric traffic keys from the [key exchange](https://ssl.sh/glossary/key-exchange/), and each sends a Finished message containing a MAC over the whole transcript, so any tampering or forced downgrade is detected.

## Why it matters
Most HTTPS failures surface here: an expired or mismatched certificate, a missing intermediate, no common protocol version or cipher, or a client that omits SNI. The handshake is also the main latency cost of TLS: a full TLS 1.2 handshake takes two round trips, a full TLS 1.3 handshake takes one, and resumption can reduce it further.

## Example
TLS 1.3 full handshake (braces mark encrypted messages):

```text
Client                                   Server
ClientHello (key_share, SNI, ALPN) -->
                                   <--   ServerHello (key_share)
                                         {EncryptedExtensions}
                                         {Certificate}
                                         {CertificateVerify}
                                         {Finished}
{Finished}                         -->
[Application data]                <-->   [Application data]
```

To watch a real handshake and see the negotiated version, cipher and certificate chain:

```bash
openssl s_client -connect example.com:443 -servername example.com
```

## Common misconceptions
- **"The certificate's key encrypts the traffic."** In modern handshakes the certificate key only signs; traffic keys come from an ephemeral key exchange.
- **"Every request triggers a handshake."** A handshake happens per connection, and HTTP keep-alive, HTTP/2 multiplexing and session resumption avoid most repeats.
- **"Handshake failures are always certificate problems."** Version or cipher mismatches, missing SNI and interfering middleboxes are just as common.

## Related terms

- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [TLS 1.2](https://ssl.sh/zh/glossary/tls-1-2/): TLS 1.2 是 2008 年由 RFC 5246 定义的 TLS 版本，引入了基于 SHA-256 的密钥派生和 AES-GCM 等 AEAD 加密算法，至今仍被广泛使用。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [SNI](https://ssl.sh/zh/glossary/sni/): SNI 是 TLS 的一个扩展，客户端在 ClientHello 中写明要访问的域名，使同一个 IP 能为多个 HTTPS 站点分别返回各自的证书。
- [ALPN](https://ssl.sh/zh/glossary/alpn/): ALPN 是一个 TLS 扩展，让客户端和服务器在握手过程中直接商定上层协议，例如 h2 或 http/1.1，不需要额外往返。
- [会话恢复](https://ssl.sh/zh/glossary/session-resumption/): 会话恢复是 TLS 的一种机制，客户端重连时复用先前会话的密钥材料，跳过完整的密钥交换和证书验证。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。