What happens in a TLS 1.3 handshake when you open an https:// site?

TLS gives a connection three things: confidentiality (encryption), integrity (tampering is detected), and server authentication (you are really talking to the site named in the URL).

TLS 1.3 handshake, simplified (after the TCP connection is open)

1. ClientHello. The browser sends the TLS versions and cipher suites it supports, a random value, the server name (SNI), and a key share: its ephemeral (EC)DH public value for a likely key-exchange group, such as X25519.
2. ServerHello. The server picks the version and cipher suite and sends its own key share. Both sides can now compute the same shared secret using (EC)DHE and derive handshake keys from it. Everything after this point is encrypted.
3. Certificate + CertificateVerify. The server sends its certificate chain and a signature over the handshake transcript, made with the certificate's private key. The browser checks that:

• the chain leads to a trusted root CA;
• the certificate is valid for this hostname and is not expired (and, depending on policy, not revoked);
• the signature verifies, which proves the server holds the private key. This defeats impostors and man-in-the-middle attacks.

1. Finished. Each side sends a MAC over the whole handshake, which proves nobody tampered with the negotiation (for example, by forcing a weaker cipher).
2. Application data (HTTP) flows, encrypted with an AEAD cipher (AES-GCM or ChaCha20-Poly1305) using keys derived from the shared secret.

What each part protects against

• Ephemeral key exchange gives forward secrecy: recorded traffic stays safe even if the server's long-term key leaks later.
• The certificate and signature stop impersonation.
• The Finished MACs stop downgrade and tampering attacks during the handshake.
• AEAD record protection gives confidentiality and integrity for each message.

TLS 1.3 compared with TLS 1.2

• One round trip for a full handshake instead of two, and optional 0-RTT resumption. 0-RTT data can be replayed, so it should be used only for safe, idempotent requests.
• Removes old, weak options: RSA key transport (no forward secrecy), static DH, CBC-mode ciphers, RC4, SHA-1 and MD5 in signatures, and compression.
• Encrypts more of the handshake, including the certificate.

What TLS does not do: it does not hide which IP address you connect to, and normally not the domain either, since SNI is visible unless Encrypted Client Hello is used. It does not protect data once it reaches the server, and it does not make a malicious site safe. HSTS stops browsers from being downgraded to plain HTTP.