TLS 1.3: how the secure handshake works

A TLS 1.3 handshake negotiates cryptographic parameters, performs key agreement and authenticates the server with a certificate before application data is protected. Session resumption can reduce later setup work but does not remove certificate and identity considerations.

What happens during a TLS 1.3 handshake

During a TLS 1.3 handshake, the client and server negotiate cryptographic parameters, perform key agreement and the server presents a certificate so the client can check the hostname and trust chain. Application data is protected after that negotiation succeeds.

How to check a TLS connection

Check the certificate and negotiated TLS version for the actual hostname. For a failure, compare the hostname, certificate chain and client error. An open TCP/443 port proves only TCP reachability; it does not prove that the TLS handshake succeeds. You can separately check basic server reachability with 2ip server check.

Why an open port 443 is not enough

Technical references: RFC 8446.