An overview of the SSL/TLS handshake

The SSL/TLS handshake enables the TLS client and server to establish the secret keys with which they communicate.

This section provides a summary of the steps that enable the TLS client and server to communicate with each other.

  • Agree on the version of the protocol to use.
  • Select cryptographic algorithms.
  • Authenticate each other by exchanging and validating digital certificates.
  • Use asymmetric encryption techniques to generate a shared secret key, which avoids the key distribution problem. TLS then uses the shared key for the symmetric encryption of messages, which is faster than asymmetric encryption.

For more information about cryptographic algorithms and digital certificates, refer to the related information.

In overview, the steps involved in the TLS handshake are as follows:
  1. The TLS client sends a client hello message that lists cryptographic information such as the TLS version and, in the client's order of preference, the CipherSuites supported by the client. The message also contains a random byte string that is used in subsequent computations. The protocol allows for the client hello to include the data compression methods supported by the client.
  2. The TLS server responds with a server hello message that contains the CipherSuite chosen by the server from the list provided by the client, the session ID, and another random byte string. The server also sends its digital certificate. If the server requires a digital certificate for client authentication, the server sends a client certificate request that includes a list of the types of certificates supported and the Distinguished Names of acceptable Certification Authorities (CAs).
  3. The TLS client verifies the server's digital certificate. For more information, see How TLS provides identification, authentication, confidentiality, and integrity.
  4. The TLS client sends the random byte string that enables both the client and the server to compute the secret key to be used for encrypting subsequent message data. The random byte string itself is encrypted with the server's public key.
  5. If the TLS server sent a client certificate request, the client sends a random byte string encrypted with the client's private key, together with the client's digital certificate, or a no digital certificate alert. This alert is only a warning, but with some implementations the handshake fails if client authentication is mandatory.
  6. The TLS server verifies the client's certificate. For more information, see How TLS provides identification, authentication, confidentiality, and integrity.
  7. The TLS client sends the server a finished message, which is encrypted with the secret key, indicating that the client part of the handshake is complete.
  8. The TLS server sends the client a finished message, which is encrypted with the secret key, indicating that the server part of the handshake is complete.
  9. For the duration of the TLS session, the server and client can now exchange messages that are symmetrically encrypted with the shared secret key.
Figure 1 illustrates the TLS handshake.
Figure 1. Overview of the TLS handshake
This diagram illustrates the TLS handshake as described in the text preceding the diagram.