HTTPS & TLS Behind the Lock: Asymmetric Handshakes, Symmetric Ciphers & PKI
What really happens during a TLS 1.3 handshake: ECDHE key exchange, symmetric session keys, Certificate Authorities, Forward Secrecy, and HSTS.
By Amr Samir• August 19, 2026• 2 min
HTTPS & TLS Behind the Lock: Asymmetric Handshakes, Symmetric Ciphers & PKI
1. What Really Happens Behind the Green Padlock
HTTPS is HTTP layered over Transport Layer Security (TLS). It provides three essential guarantees:
- Confidentiality (Encryption): Prevents eavesdroppers from reading transmitted packets.
- Integrity: Detects any alteration or tampering of data in transit.
- Authentication: Proves the client is communicating with the genuine server, not an impostor.
code
+-------------------------------------------------------+
| Application (HTTP) |
+-------------------------------------------------------+
| TLS Layer (Encryption & Integrity) |
+-------------------------------------------------------+
| TCP Transport |
+-------------------------------------------------------+
| IP Network |
+-------------------------------------------------------+
2. The TLS 1.3 Handshake (1-RTT)
code
+--------+ +--------+
| Client | --- 1. ClientHello (Cipher Suites + Key Share)->| Server |
| | | |
| | <--- 2. ServerHello (Key Share + Certificate) --| |
| | + EncryptedExtensions + Finished | |
| | | |
| | [ Derive Symmetric AES-GCM Session Key ] | |
| | | |
| | === 3. Encrypted Application Data (HTTP/2) ===> | |
| | <== 4. Encrypted Application Data (HTTP/2) ==== | |
+--------+ +--------+
3. Asymmetric vs Symmetric Encryption Roles
- Asymmetric Encryption (ECDHE / RSA): Computationally heavy; used exclusively during the initial handshake to authenticate server certificates and securely agree upon a shared secret.
- Symmetric Encryption (AES-GCM / ChaCha20-Poly1305): Extremely fast with hardware CPU acceleration; used to encrypt all actual application traffic using the agreed session key.
4. Public Key Infrastructure (PKI) & Certificate Authorities (CA)
How does your browser verify that google.com belongs to Google?
- The server presents a certificate signed by an intermediate CA.
- The browser walks up the certificate chain to a pre-installed Root Certificate Authority in the OS trust store.
- If any signature in the chain is invalid or expired, the browser blocks the connection with a security alert.
5. Summary
- TLS 1.3 reduces handshake latency to a single round-trip (1-RTT).
- Ephemeral Diffie-Hellman (ECDHE) guarantees Forward Secrecy: even if server private keys are compromised in the future, past recorded sessions cannot be decrypted.
