Protocols & Standards

What Is TLS Handshake?

The TLS handshake is the negotiation at the start of every secure connection: client and server agree on protocol version and cipher, the server proves its identity with its certificate (and in mTLS, the client does too), and both sides derive the symmetric session keys that encrypt the actual traffic. Every certificate error you have ever seen happened here.

TLS 1.3 in one round trip

The client’s ClientHello offers supported ciphers and a key share (typically X25519 — increasingly hybridized with post-quantum ML-KEM); the server answers with its own key share, its certificate chain and a CertificateVerify signature proving possession of the private key. One round trip, and encryption is on before any HTTP flows. TLS 1.3 also encrypts the certificate itself and removed the entire catalogue of legacy weaknesses (RSA key exchange, renegotiation, compression).

Where handshakes fail

Certificate-side failures dominate: expired certificates, hostname not in the SAN list, incomplete chains (missing intermediate), untrusted or internal roots, and clock skew on the client. Protocol-side failures — no cipher overlap, ancient TLS versions, SNI mismatches on multi-tenant hosts — make up the rest. The fastest diagnosis is usually reading what the server actually serves.

openssl s_client -connect example.com:443 -servername example.com -showcerts

Session keys, not certificate keys

The certificate’s key pair only authenticates the handshake; the traffic itself is encrypted with fresh symmetric keys derived per connection. That separation gives forward secrecy: even a later theft of the server’s private key cannot decrypt recorded past sessions.

Try it yourself — free tools

Certificate Checker — see the certificate and chain a live server presents in its handshake
OCSP Checker — check the revocation status a strict client would enforce

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.