The TLS Handshake
How secure sessions start.
The TLS Handshake is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is the TLS Handshake?
The TLS handshake is the negotiation that happens before any encrypted data flows.
It lets a client and server agree on encryption parameters, verify identity, and establish shared secret keys.
Goals of the Handshake
A TLS handshake achieves three things:
- Authentication: the client verifies the server's certificate.
- Key exchange: both sides derive shared session keys.
- Negotiation: they pick a cipher suite and protocol version.
ClientHello
The client opens with a ClientHello message containing:
- Supported TLS versions
- A list of cipher suites it can use
- A random value (client random)
- Extensions like SNI (the hostname)
ServerHello
The server replies with a ServerHello, choosing the TLS version and one cipher suite from the client's list, plus its own random value.
It then sends its certificate so the client can verify identity.
Verifying the Server
The client validates the server's certificate chain: signatures, validity dates, revocation, and that the hostname matches.
If validation fails, the handshake is aborted and no data is sent.
Key Exchange
Modern TLS uses Ephemeral Diffie-Hellman (ECDHE). Both sides exchange public key shares and independently compute the same shared secret.
This gives forward secrecy: stealing the server's long-term key later cannot decrypt past sessions.
Deriving Session Keys
From the shared secret plus both random values, both sides derive symmetric session keys.
The expensive asymmetric crypto is only used to bootstrap fast symmetric encryption for the actual data.
Finished Messages
Each side sends a Finished message, encrypted with the new keys, containing a hash of the whole handshake.
If both verify, it proves no one tampered with the negotiation and the keys match.
TLS 1.3 Speedup
TLS 1.3 streamlined the handshake to a single round trip (1-RTT) and dropped insecure options.
It can even resume previous sessions with 0-RTT, sending data on the first message.
Observing a Handshake
You can watch the handshake details, including the negotiated version and cipher, with OpenSSL.
openssl s_client -connect example.com:443 -tls1_3Why It Matters
The handshake is where security is established or lost. A flawed or downgraded handshake can expose all later traffic.
Understanding it helps you diagnose connection failures and recognize attacks.
Quick Check
What benefit does ephemeral Diffie-Hellman (ECDHE) provide in the handshake?
Recap
You learned the steps of the TLS handshake.
- ClientHello / ServerHello negotiate version and cipher.
- The client verifies the certificate.
- ECDHE derives shared session keys with forward secrecy.
- TLS 1.3 made it faster and safer.
Next, we examine cipher suites in detail.
Frequently asked questions
Is the “The TLS Handshake” lesson free?
Yes — the full text of “The TLS Handshake” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “The TLS Handshake”?
How secure sessions start. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “The TLS Handshake” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- The TLS Handshake
- Cipher Suites
- Certificate Validation
- Common TLS Attacks