How do HTTPS and TLS secure communications, and what are the steps of the TLS handshake and key exchange?

Short answer

TLS secures a connection by combining asymmetric encryption for key exchange and authentication with fast symmetric encryption for the actual data stream.

Explanation

The steps are: (1) Client Hello: the client sends supported TLS versions, cipher suites, and a random value. (2) Server Hello: the server chooses an algorithm and sends its digital certificate (SSL Certificate) containing its public key. (3) Verification: the browser checks the certificate and trust chain through certificate authorities (CAs). (4) Key exchange (using Diffie-Hellman): both parties generate a shared secret session key. (5) Symmetric encryption: all subsequent data is encrypted with that key using fast algorithms such as AES-GCM.

Code example

import socket
import ssl

context = ssl.create_default_context()      # verifies the certificate chain against trusted CAs
with socket.create_connection(("example.com", 443)) as sock:
    with context.wrap_socket(sock, server_hostname="example.com") as tls:   # the TLS handshake happens here
        print(tls.version())                # e.g. TLSv1.3
        print(tls.cipher())                 # negotiated symmetric cipher for the data stream
        print(tls.getpeercert()["subject"]) # authentication: who the certificate was issued to

Common mistakes

• Ignoring Perfect Forward Secrecy (PFS) and believing that a future leak of the server's private key reveals previously recorded encrypted communications.

Follow-up questions

• Compare TCP and UDP. How does the three-way handshake help establish a reliable connection?

Sources

• Transport Layer Security - Wikipedia