TLS Handshake Cheat Sheet
TLS 1.3 and 1.2 handshake steps, cipher suites, certificate validation, and troubleshooting.
Security Tools
tls
ssl
handshake
TLS establishes a secure channel between client and server by negotiating a cipher suite, authenticating the server (and optionally the client), and deriving session keys. TLS 1.3 shortens the handshake to a single round trip.
TLS 1.3 handshake (1-RTT)
code
Client Server
|--- ClientHello ----------->|
| (key share, suites) |
|<-- ServerHello, key share -|
|<-- EncryptedExtensions, -|
|<-- Certificate, Finished --|
|--- Finished -------------->|
|<===== encrypted data =====>|
Table
| Step | Purpose |
|---|---|
| ClientHello | Propose versions, cipher suites, key share. |
| ServerHello | Select version, cipher, key share. |
| Certificate | Server proves identity. |
| Finished | Verify the handshake integrity. |
TLS 1.2 vs 1.3
Table
| Aspect | TLS 1.2 | TLS 1.3 |
|---|---|---|
| Round trips | 2 | 1 |
| Cipher suites | RSA + ECDHE | ECDHE only (forward secrecy). |
| Renegotiation | Supported | Removed. |
| Session resumption | Session IDs/tickets | PSK-based. |
Certificate validation
Table
| Check | Purpose |
|---|---|
| Chain of trust | Verify issuer up to a trusted root. |
| Validity period | Not expired, not not-yet-valid. |
| Hostname match | SAN matches the requested host. |
| Revocation | OCSP or CRL check. |
Inspect with openssl
bash
openssl s_client -connect example.com:443 -servername example.com
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -tls1_3
openssl x509 -in cert.pem -text -noout