Glossary · Networking

TLS Handshake

The TLS handshake is the exchange at the start of a secure connection where client and server agree on settings, verify identity and derive keys.

Updated October 6, 2026

The TLS handshake is the negotiation that begins every HTTPS connection. The client and server agree on a protocol version and cipher suite, the server proves its identity with a certificate, and both derive shared session keys.

Why it matters

A failed or slow handshake means no secure connection at all, producing browser warnings or connection errors. Handshake cost counts toward page load time: TLS 1.3 needs one round trip, while TLS 1.2 needs two, and session resumption can skip most of the work. Certificate problems, unsupported versions and mismatched cipher suites are the usual failure causes.

Example

$ openssl s_client -connect example.com:443 -servername example.com
Protocol  : TLSv1.3
Cipher    : TLS_AES_256_GCM_SHA384
Verify return code: 0 (ok)

The server negotiated TLS 1.3 and its certificate chain validated.

Common mistakes

  • Forgetting the SNI hostname when testing, which returns the wrong certificate.
  • Serving an incomplete certificate chain that works in some browsers but not others.
  • Leaving legacy TLS versions enabled after clients no longer need them.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCertificate Chain (Chain of Trust)A certificate chain is the ordered path of certificates from a server's leaf certificate through intermediates up to a trusted root.Glossary · SecurityCipher SuiteA cipher suite is a named bundle of algorithms for key exchange, authentication, bulk encryption and integrity used in a TLS connection.Glossary · SecurityElliptic Curve Cryptography (ECC)Elliptic curve cryptography is public-key cryptography built on elliptic curve math, giving strong security with much smaller keys than RSA.Guide · SSL & SecurityHow to Check an SSL Certificate Expiry Date (3 Easy Ways)Find out when your SSL certificate expires using a free online checker, your browser, or one command, and learn what to do if the date is close or has passed.7 min readGuide · SSL & SecuritySSL Certificate Types Explained: DV, OV, EV, Wildcard and SANCompare DV, OV and EV certificates, wildcard and multi-domain (SAN) options, and learn what certificate lifetimes really are today and where they are heading.7 min readGuide · SSL & SecuritySSL/TLS Certificate Errors Explained: Causes, Diagnosis and FixesDecode browser errors like ERR_CERT_COMMON_NAME_INVALID and ERR_CERT_AUTHORITY_INVALID, diagnose them with openssl and curl, and fix each root cause.10 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.