A TLS handshake negotiates protocol version and cipher suite, authenticates the server with a certificate chain, and establishes shared session keys. Current practice requires TLS 1.2 or 1.3; SSL and early TLS versions are deprecated and prohibited by modern standards and regulation.
TLS protects the channel between two endpoints, nothing more. It does not protect data before it enters the channel or after it leaves; it does not authenticate that the destination is the service the user intended to reach beyond what the certificate asserts, and it creates inspection and visibility trade-offs that networks must design around deliberately.
Key points
Handshake and trustVersion and cipher negotiation, server authentication via certificate chain, optional client authentication, and session-key establishment authenticated by the endpoint’s private key.
Deployment requirementsSupported versions only, strong cipher suites, valid certificate chains with managed renewal, correct server-name indication and virtual-host handling, and secure renegotiation and resumption behavior.
Visibility trade-offsEncryption protects content from intermediaries — including defenders — so inspection must be an explicit, governed design choice rather than an assumed capability.
Important limitationTLS authenticates and encrypts a channel between endpoints; it cannot vouch for what happens at either end. Compromised endpoints, misissued or mistrusted certificates, downgrade paths, and terminated-then-reencrypted traffic all erode the guarantee.