TLS Handshake Explained
The handshake is a negotiation plus a key exchange. With TLS 1.3, the client sends its supported key shares and the server responds with its choice, its certificate, and its Finished — one round trip, and both sides have derived the same session keys and proven possession of them.
Topics covered:
- The negotiation: cipher suites, versions, and key share selection
- Key exchange: ECDHE and why forward secrecy requires ephemeral keys
- Authentication: the certificate chain and the signature proving possession
- The Finished messages: proving both sides derived identical keys
- TLS 1.3's one-round-trip handshake vs. TLS 1.2's two
- Session resumption: PSKs, 0-RTT, and their replay constraints
Related articles
TLS 1.3 Handshake Round Trips: 1-RTT, PSK Resumption, and 0-RTT
The TLS 1.3 handshake in one round trip — key shares, the transcript signature, session resumption with PSKs, and the replay risks of 0-RTT data.
What Happens When You Call an API?
One request, traced end to end: DNS, TCP, TLS, HTTP, load balancing, server logic, and the database — with the real cost of every hop.
How TLS Actually Secures a Connection
From the ClientHello to the session ticket: what every message in a TLS handshake does, why certificates are the center of the trust model, and how TLS 1.3 changed the game.
More in Networking
HTTP/3 and QUIC Explained
The transport protocol that replaces TCP — multiplexing without head-of-line blocking, connection migration, and 0-RTT.
WatchThe Full Lifecycle of an HTTP Request
Watch a single request travel from a browser through DNS, TCP, TLS, HTTP, a load balancer, a server, and a database — with live packet-level tracing.
WatchIP Routing Explained
How a packet travels from host to host — longest-prefix matching in forwarding tables, next-hop resolution, and what actually changes at every router along the way.
DetailsLoad Balancing Protocols
Layer 4 vs. layer 7 balancing, NAT rewrites, and health checks — the actual packet and request flows that distribute traffic across a backend pool.
DetailsSockets and the Network Stack
The path a byte takes from a syscall to the wire — sockets, kernel buffers, queues, and protocol layers, and where sendto and recvfrom actually do their work.
DetailsCongestion Control Visualized
How TCP probes for available bandwidth — slow start, congestion avoidance, and packet loss as the signal that tells senders when to back off.
DetailsHTTP/2 and HTTP/3
Streams, frames, and the transports underneath — what HTTP/2 multiplexing changes at the application layer and what moving to QUIC changes at the transport layer.
DetailsDNS Resolution Visualized
Follow a query from stub resolver to authoritative server — cache hits, recursive walking, TTL expiry, and the exact packet flow that turns a hostname into an IP.
DetailsTCP Three-Way Handshake Explained
SYN, SYN-ACK, ACK — the exact packets that open a TCP connection, the sequence numbers that synchronize both directions, and what each side actually stores.
DetailsDepth, delivered weekly
One technical dispatch a week — articles and episode notes before they go public.
One technical dispatch per week. No noise.