AnyProxy

Get Pro
Glossary · Web tech

TLS handshake

Also calledssl handshaketls negotiation
Definition

The TLS handshake is the opening exchange of every HTTPS connection, in which browser and server agree on encryption keys and the server proves which site it is.

Explanation

In depth

Before any page data moves, the browser sends a ClientHello. It lists the TLS versions and ciphers it supports, a key share, and the site name (SNI). The server replies with its choice, its own key share and its certificate. The browser checks the certificate against authorities it trusts, both sides derive the same session keys, and only then is the request sent, encrypted. TLS 1.3 (RFC 8446, 2018) does this in one round trip and encrypts the certificate. TLS 1.2 needs two round trips. The handshake matters beyond security. It is where filters read the site name and send resets, and its length is a measuring stick: OONI caught throttling in Turkiye in September 2025 because handshakes to targeted platforms took much longer than to 19 other hosts on the same IP prefixes. Modern handshakes also carry new key exchanges. Cloudflare's trace page, opened through each AnyProxy region on 15 October 2026, reported TLS 1.3 with X25519MLKEM768, a hybrid that adds a post-quantum algorithm to classic X25519. Not every site has caught up. In the 5 October 2026 DomainScan scan, croxyproxy.com, blockaway.net, proxyium.com, reuters.com, aliexpress.com and aljazeera.com still negotiated TLS 1.2.

In practice

TLS handshake in the real world

Each AnyProxy region's onward handshake, as Cloudflare saw it on 15 Oct 2026: tls=TLSv1.3 and kex=X25519MLKEM768 from Singapore, Frankfurt and Virginia alike. The browser-side leg also uses TLS 1.3. sg., fr. and us.anyproxy.site negotiated TLSv1.3 with ALPN h2 in an openssl check the same day. In the 5 Oct 2026 DomainScan scan, anyproxy.site negotiated TLS 1.3 while CroxyProxy, BlockAway and Proxyium negotiated TLS 1.2.

Sources: RFC 8446 — TLS 1.3 · OONI — Throttling of social media in Turkiye (20 Nov 2025) · Cloudflare trace page used in the tests

Measured · 2026-10-05

TLS versions negotiated

From a DomainScan scan of 37 popular sites and 8 web proxies.

TLS 1.333 sites
TLS 1.23 sites: Al Jazeera, Reuters, AliExpress
Free web proxiesCroxyProxy 1.2 · ProxySite 1.3 · BlockAway 1.2 · Proxyium 1.2 · 4everProxy 1.3 · 911Proxy 1.3
anyproxy.siteTLS 1.3

We checked

What one.one.one.one/cdn-cgi/trace reported through each AnyProxy region

Cloudflare trace page opened through AnyProxy Singapore, listing colo=SIN, loc=SG, http=http/2, tls=TLSv1.3 and sni=plaintext, with the IP line hidden

Open Cloudflare's diagnostic page one.one.one.one/cdn-cgi/trace through the Singapore region

Worked · SG exit · 2026-10-15

Page loaded as plain text: colo=SIN, loc=SG, tls=TLSv1.3, http=http/2, sni=plaintext, kex=X25519MLKEM768. The ip= line (the proxy's exit address) was hidden before the screenshot.

Cloudflare trace page opened through AnyProxy Frankfurt, listing colo=FRA, loc=DE, http=http/2, tls=TLSv1.3 and sni=plaintext, with the IP line hidden

Open Cloudflare's diagnostic page one.one.one.one/cdn-cgi/trace through the Frankfurt region

Worked · FR exit · 2026-10-15

Page loaded as plain text: colo=FRA, loc=DE, tls=TLSv1.3, http=http/2, sni=plaintext, kex=X25519MLKEM768. The ip= line (the proxy's exit address) was hidden before the screenshot.

Cloudflare trace page opened through AnyProxy Virginia, listing colo=ATL, loc=US, http=http/2, tls=TLSv1.3 and sni=plaintext, with the IP line hidden

Open Cloudflare's diagnostic page one.one.one.one/cdn-cgi/trace through the Virginia region

Worked · US exit · 2026-10-15

Page loaded as plain text: colo=ATL, loc=US, tls=TLSv1.3, http=http/2, sni=plaintext, kex=X25519MLKEM768. The ip= line (the proxy's exit address) was hidden before the screenshot. Cloudflare answered from its Atlanta data centre for the Virginia region.

Questions about TLS handshake

Is TLS 1.2 unsafe?
TLS 1.2 with modern ciphers is still considered secure. TLS 1.3 is faster, encrypts more of the handshake and drops older options. TLS 1.0 and 1.1 are deprecated.
What does X25519MLKEM768 mean?
It is a hybrid key exchange: classic X25519 combined with ML-KEM-768, a post-quantum algorithm. The connection stays secure if either one holds up.
Why does a connection fail during the handshake?
Usually an expired or wrong-name certificate, or a network that resets the connection after reading the site name. A slow handshake on one site only can mean throttling.

Related terms

TLS SNISNI (Server Name Indication) is the field at the start of an HTTPS connection where your browser names the site it wants, usually in readable text.ESNI / ECHEncrypted Client Hello (ECH) encrypts the opening message of an HTTPS connection, hiding the real site name (SNI) from the network; it replaced the earlier ESNI draft.MITM (Man-in-the-Middle)A man-in-the-middle (MITM) is anything that sits between you and a website and can read or change the traffic, whether as an attack, as company policy or as a service you chose.HTTPS proxyAn HTTPS proxy is a proxy you connect to over an encrypted (TLS) link, so even the name of the site you ask it for is hidden from your local network.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page