What Happens During an SSL Handshake?
Reading time: 5–6 minutes
Introduction
Every time you visit a secure website, something important happens before the page fully loads.
Your browser and the website have a brief conversation that usually lasts less than a second.
During this conversation, they verify each other's identity, agree on encryption methods, and create a secure connection that protects everything you do online.
This process is called the SSL handshake (more accurately, the TLS handshake on modern websites).
Although most users never notice it, every secure HTTPS website relies on this process before any sensitive information is exchanged.
Step 1 – Client Hello
The SSL handshake begins when your browser contacts the web server.
Your browser sends a Client Hello message containing:
Supported TLS versions
Supported encryption algorithms (cipher suites)
A randomly generated value
Additional security capabilities
At this stage, your browser is essentially asking:
"Here's what I support. Can we establish a secure connection?"
Step 2 – Server Hello
The server responds with a Server Hello.
It chooses:
The TLS version to use
The encryption algorithm
Another random value
The server also sends its digital certificate so the browser can verify its identity.
Step 3 – Certificate Verification
Before any encrypted communication begins, your browser checks whether the certificate can be trusted.
It verifies:
The certificate has not expired.
The domain name matches.
The certificate was issued by a trusted Certificate Authority (CA).
The certificate has not been revoked.
The certificate chain is complete.
If any of these checks fail, the browser may display warnings such as:
"Your connection is not private."
or
"NET::ERR_CERT_AUTHORITY_INVALID"
Without successful verification, the secure connection cannot continue.
Step 4 – Secure Key Exchange
Once the certificate has been validated, the browser and server securely generate a shared session key.
This key is unique to your connection.
Importantly, the key itself is never transmitted directly across the internet.
Instead, both devices independently calculate the same encryption key using modern cryptographic methods.
Step 5 – Encrypted Communication Begins
With the shared session key created, the SSL handshake is complete.
From this point forward:
Login credentials are encrypted.
Payment information remains protected.
Personal information stays private.
Website traffic cannot easily be intercepted or modified.
The browser now displays the familiar HTTPS connection, indicating that encrypted communication has been established.
Why This Happens So Quickly
Modern TLS handshakes are highly optimized.
On most websites, the entire process completes in just a few milliseconds.
Visitors rarely notice it happening, yet it is one of the most important security processes on the modern internet.
What Happens If the SSL Handshake Fails?
If the handshake cannot be completed successfully, the secure connection never begins.
Common causes include:
Expired SSL certificates
Incorrect server configuration
Missing intermediate certificates
Unsupported TLS versions
Certificate hostname mismatches
Revoked certificates
When this happens, browsers typically block access or display security warnings to protect visitors.
For a detailed breakdown, read:
→ Common SSL Handshake Errors
Real-World Example
Imagine you're logging into your online banking account.
Before your username and password are transmitted, your browser first performs the SSL handshake.
Only after both your browser and the bank successfully verify each other does encrypted communication begin.
Without this process, sensitive information could potentially be exposed while travelling across the internet.
Frequently Asked Questions
Does every HTTPS website perform an SSL handshake?
Yes. Every new HTTPS connection begins with a TLS handshake before encrypted communication starts.
Is the SSL handshake still called SSL today?
Most modern websites actually use TLS rather than SSL.
However, the phrase SSL handshake remains widely used because it is familiar to most users.
Can users see the SSL handshake?
Not directly.
The process happens automatically in the background and usually completes before the webpage finishes loading.
How long does an SSL handshake take?
Typically less than one second.
On well-configured websites, it often completes within a few milliseconds.
Final Thoughts
Every secure website begins with one simple conversation.
Your browser asks if it can trust the website.
The website proves its identity.
Encryption is established.
Only then does secure communication begin.
Although the SSL handshake happens in the background, it is one of the most important security processes protecting the modern internet.
Related Articles
Related Cyber Story
📖 The SSL Handshake That Never Happened
A secure connection that never began and the customers who never came back.