The TLS 1.3 Handshake

TLS 1.3 reduced the handshake from two round-trips to one, removed insecure algorithms, and encrypted more of the negotiation.

ClientHello

The client sends cipher suites, key shares (X25519, P-256), TLS versions, and extensions. The ClientHello is the foundation of TLS fingerprinting — the ordered list of cipher suites and extensions forms a stable per-implementation fingerprint.

ServerHello + EncryptedExtensions

The server selects a cipher suite and key share. Everything after ServerHello is encrypted — including the certificate.

What Changed From TLS 1.2

Static RSA removed — all suites provide forward secrecy. Cipher suite list went from dozens to five. Renegotiation and compression removed. 0-RTT resumption added.