DNS & Glossary

TLS handshake

The negotiation that starts every HTTPS connection: the client and server authenticate, agree on a cipher, and derive shared keys before any application data is sent.

What it is

In the handshake the server presents its certificate, the parties agree on a cipher suite and protocol version (via ALPN for HTTP/2), and they derive session keys using ephemeral key exchange for forward secrecy. TLS 1.3 cut this from two round trips to one.

Why it matters

  • Handshake latency is a real contributor to connection setup time, especially on mobile.
  • It is where server identity is verified — a failure here means no secure connection.

Common mistakes

  • Large certificate chains that bloat the handshake.
  • Not enabling session resumption, forcing a full handshake on every connection.

How WebInspect checks this

  • WebInspect reports the negotiated TLS version, cipher, ALPN protocol and handshake timing.