The browser starts the conversation.
It sends a Client Hello message containing:
Supported TLS versions
Supported cipher suites
A random value
Security capabilities
The browser is essentially asking:
"Can we communicate securely?"
The server replies with a Server Hello.
It selects:
The TLS version
The encryption algorithm
Its own random value
At this point, both devices begin negotiating how the secure connection will work.
Step 3 — Certificate Delivery
The server now sends its SSL/TLS certificate.
The certificate proves the website's identity and allows the browser to verify that it is communicating with the correct server.
Step 4 — Certificate Verification
Before continuing, the browser performs several security checks.
It verifies:
The certificate has not expired.
The domain name matches.
The certificate was issued by a trusted Certificate Authority (CA).
The certificate has not been revoked.
The certificate chain is complete.
If any of these checks fail, the browser may display a security warning instead of loading the website.
Step 5 — Secure Key Exchange
Once the certificate has been trusted, both the browser and server securely generate the same session encryption key.
The key itself is never sent across the internet.
Instead, both devices independently calculate the same shared key using cryptographic algorithms.
Secure HTTPS Communication Begins
After the session key has been created, the SSL handshake is complete.
Everything that follows is encrypted, including:
Login credentials
Payment information
Personal data
Website traffic
The familiar HTTPS padlock now represents an active encrypted connection.
Although the SSL handshake appears simple, every step has an important purpose.
Without this process:
Every secure HTTPS website depends on this sequence before data is exchanged.
Frequently Asked Questions
Is this the same as the TLS handshake?
Yes.
Modern websites use TLS rather than SSL.
However, the phrase SSL handshake remains the most commonly used name.
Does every HTTPS website perform this process?
Yes.
Every new HTTPS connection begins with a TLS handshake before encrypted communication starts.
Can one failed step stop the connection?
Yes.
If certificate verification or key exchange fails, the browser cannot establish a secure encrypted connection.
How long does the SSL handshake take?
Usually less than one second.
On well-configured websites, it often completes in just a few milliseconds.
The SSL handshake may happen in the background, but it is responsible for establishing trust every time you visit a secure website.
Understanding each step helps explain why HTTPS remains one of the most important technologies protecting the modern internet.
📖 The SSL Handshake That Never Happened
A secure connection that never began and the customers who never came back.
