TCP + TLS 1.3 handshake

Client

your browser

TCP — opening the connection

1. SYN (seq = x)

2. SYN-ACK (seq = y, ack = x+1)

3. ACK (ack = y+1)

TLS 1.3 — securing it

4. ClientHello — cipher suites + X25519 key share

5. ServerHello + certificate + key share

Server

example.com:443

private (client)
+ public (server)

↘↙

🔑 same session key

derived independently on each side — never sent over the wire

private (server)
+ public (client)

One continuous handshake — TCP opens the pipe, then TLS secures it, before a single byte of the real request goes out.