hafeez@unixshadow:~$ openssl s_client -connect unixshadow.com:443 # how HTTPS gets its S
TLS 1.3 Handshake
How HTTPS Gets Its Stripes
TCP proved both directions work. now the two sides agree on secrets — before a byte of HTTP exists.
# the handshake — one round trip // TLS 1.3
TCP readyCLIENT
ClientHello
random · cipher suites · SNI · key share
listeningSERVER
waitingCLIENT
ServerHello + Certificate + Finished
chosen suite · key share · cert chain
verifiedSERVER
ENCRYPTEDCLIENT
Finished
proof I derived the same keys
ENCRYPTEDSERVER
everything after this line is ciphertext — HTTP finally speaks.
# why 1.3 matters // round trips to first byte
TLS 1.2
2-RTT
TLS 1.3
1-RTT
# 1.3 folds the key exchange into the first flight — and resumption can hit 0-RTT.
# the certificate chain // trust, delegated
# your browser trusts the root, the root (via the intermediate) vouches for the leaf. break one link, the padlock breaks.
# field guide
- SNI
- Server Name Indication — the hostname, sent in the clear so one IP can serve many sites.
- ALPN
- Application-Layer Protocol Negotiation — “shall we speak h2?”
- cipher suite
- the agreed recipe: key exchange + encryption + hash. 1.3 trimmed the menu to five safe ones.
- forward secrecy
- ephemeral keys per session — steal today’s key, learn nothing about yesterday.
- session resumption
- skip the handshake on reconnect via tickets or PSK. 0-RTT if you’re brave.
# see it live
# interrogate any server’s TLS:
openssl s_client -connect example.com:443 -servername example.comcurl -vI https://example.com — watch the handshake in the verbose lognmap --script ssl-enum-ciphers example.com — which suites are offeredunixshadow.com · VPS & hosting from the shadowshafeez@unixshadow:~$