Glossary · Web tech

TLS handshake

Also calledssl handshaketls negotiation

Definition

The TLS handshake is the initial exchange between client and server that agrees on encryption keys and verifies the server's identity before any application data flows.

Explanation

In depth

Every HTTPS connection starts with a TLS handshake. The browser sends a ClientHello (with the SNI hostname, supported ciphers, TLS version). The server responds with ServerHello (chosen cipher, certificate). Client verifies the certificate against trusted roots. Both sides derive shared session keys. Only then does the request itself get sent, encrypted with the session keys. In TLS 1.3 (the modern default) the handshake completes in one round-trip and much of it is encrypted. The parts that stay in plaintext are the SNI hostname and the TLS version — which is why SNI is the primary DPI target for censorship. ECH (Encrypted Client Hello) hides even those.

Related terms

TLS SNITLS Server Name Indication (SNI) is a field in the TLS handshake that names the destination hostname — visible to any network observer even when the connection itself is encrypted.ESNI / ECHEncrypted Client Hello (ECH) hides the TLS SNI hostname from network observers — the modern replacement for the earlier ESNI proposal.MITM (Man-in-the-Middle)A man-in-the-middle intercepts traffic between two parties — reading, modifying, or blocking the communication without either endpoint knowing.HTTPS proxyAn HTTPS proxy is an HTTP proxy that supports the CONNECT method for tunneling encrypted HTTPS traffic to any destination.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page