What Is an SSL Handshake? (Step-by-Step Guide)

Reading time: 6 min

What is an SSL Handshake?

An SSL handshake is the process that takes place when your browser connects securely to a website using HTTPS. During this process, the browser and the web server verify each other's identity, agree on encryption methods, and establish a secure encrypted connection before any sensitive information is exchanged.

Without the SSL handshake, secure browsing, online banking, eCommerce, and encrypted communications would not be possible.

SSL Handshake at a Glance Purpose:

Establishes a secure encrypted connection.
Time Required: Usually less than one second.
Used By: Every HTTPS website.
Modern Version: TLS 1.2 and TLS 1.3.
Main Goal: Verify identity and create encryption keys.

Why is an SSL Handshake Important?

The SSL handshake ensures that:

Your connection is encrypted.
You're communicating with the correct website.
Sensitive information cannot be easily intercepted.
Encryption keys are created securely.
Data remains private while travelling across the internet.

This entire process typically takes only a fraction of a second.

How the SSL Handshake Works

Step 1 – Client Hello

When you visit a secure website, your browser sends a Client Hello message to the web server.

This message includes:

Supported TLS versions
Supported encryption algorithms (cipher suites)
A randomly generated number
Additional security capabilities

The browser is essentially asking:

"Here's what I support. Can we establish a secure connection?"

Step 2 – Server Hello

The server responds with a Server Hello message.

It selects:

The TLS version to use
The encryption algorithm
Its own random number

The server also sends its SSL/TLS certificate.

Step 3 – Certificate Verification

Your browser now verifies the certificate by checking:

Is the certificate still valid?
Has it expired?
Is it signed by a trusted Certificate Authority (CA)?
Does the certificate match the website's domain name?
Has the certificate been revoked?

If any of these checks fail, your browser may display a warning such as:

"Your connection is not private."

Step 4 – Key Exchange

Once the certificate has been verified, the browser and server securely exchange cryptographic information to generate a shared session key.

This session key is unique for that connection and is never transmitted directly across the network.

Step 5 – Secure Connection Established

Both the browser and server now possess the same session key.

From this point onward:

Website traffic is encrypted.
Login credentials remain protected.
Payment information stays private.
Data cannot be easily read if intercepted.

The secure HTTPS session begins.

Common SSL Handshake Errors

Problems can occur if:

The SSL certificate has expired.
The certificate doesn't match the website domain.
TLS versions are incompatible.
The server configuration is incorrect.
Certificate intermediates are missing.
The certificate has been revoked.

These issues can prevent a secure connection from being established.

SSL vs TLS Handshake

Although many people still refer to it as an SSL handshake, modern websites actually use TLS handshakes.

SSL has been deprecated due to security vulnerabilities.

Today's secure websites typically use:

TLS 1.2
TLS 1.3

The term "SSL handshake" remains common because it is widely recognised, even though the underlying technology is TLS.

Frequently Asked Questions

Is an SSL handshake secure?

Yes. Modern TLS handshakes use advanced cryptographic techniques to establish encrypted communication securely.

How long does an SSL handshake take?

Usually less than one second. On well-optimised websites, it often completes in just a few milliseconds.

Can an SSL handshake fail?

Yes. Common causes include expired certificates, invalid certificates, unsupported TLS versions, or incorrect server configuration.

Does every HTTPS connection perform an SSL handshake?

Yes. Every new secure HTTPS connection begins with a TLS handshake before encrypted communication starts.

Related Cyber Story

📖 The SSL Handshake That Never Happened

"A customer clicked. The browser waited. The secure connection never started."

What is an SSL Certificate?
How SSL Works
HTTP vs HTTPS
What is TLS?
SSL vs TLS
Certificate Chain Explained (Coming Soon)

What Is an SSL Handshake? (Step-by-Step Guide)