Every https:// connection starts with a TLS handshake — the few milliseconds where your browser and a server you've never met agree on a shared secret and prove the server is who it claims. It combines every other crypto primitive.
What happens
1. ClientHello — "here are the ciphers I support"
2. ServerHello — picks a cipher, sends its certificate
3. Verify cert — browser checks the cert chain (see PKI)
4. Key exchange — both derive a shared secret (ECDHE)
5. Switch to symmetric — fast AES encryption for the restThe clever part
- Asymmetric crypto is used only to safely agree on a key.
- Then they switch to fast symmetric AES for the actual data.
- Certificates prove the server's identity (so you're not handshaking with an impostor).
- Forward secrecy (ephemeral keys) means stealing the server's key later can't decrypt past traffic.
The handshake solves an astonishing problem: two strangers, over a wire anyone can read, end up sharing a secret no eavesdropper can learn.
Provision the certs that make it work with TLS Automation with Let's Encrypt.
Related: Public Key Infrastructure · Symmetric vs Asymmetric Encryption · TLS Automation with Let's Encrypt