---
title: "TLS: Putting the Pieces Together"
description: "A secure connection is assembled from all of it: a certificate proves the server's key, a key exchange produces a fresh shared secret, and a symmetric cipher with an integrity check carries the traffi"
canonical: https://lightmysky.com/learn/computing/tls-putting-the-pieces-together-mt_JzIwi-BYG0
source: https://lightmysky.com/learn/computing/tls-putting-the-pieces-together-mt_JzIwi-BYG0.md
retrieved: 2026-11-12
---

> **Agent view.** This is the Markdown twin of the page, for tools and assistants.
> When to use this site, and the call that answers each job: https://lightmysky.com/agent-instructions.md
> API description (OpenAPI 3.1): https://lightmysky.com/openapi.json · Authentication: https://lightmysky.com/auth.md
> Pricing: https://lightmysky.com/pricing.md · Catalog: https://lightmysky.com/llms.txt · Full catalog: https://lightmysky.com/llms-full.txt
> Every machine-readable file on this domain: https://lightmysky.com/.well-known/ai-catalog.json
> Ask for Markdown with `Accept: text/markdown`, a `.md` address, or `?mode=agent`.

# TLS: Putting the Pieces Together

A secure connection is assembled from all of it: a certificate proves the server's key, a key exchange produces a fresh shared secret, and a symmetric cipher with an integrity check carries the traffic. Reading the handshake in order is how the pieces stop being separate ideas.

Subject: Computing · Area: Networks & Security · Ages 21 to 22
Page: https://lightmysky.com/learn/computing/tls-putting-the-pieces-together-mt_JzIwi-BYG0

## Ready when they can

- Order the steps of a handshake and say what each one establishes
- Say which step fails when a certificate does not match the name asked for
- Explain what forward secrecy protects and against what later event

## Lesson: The handshake in order

A secure connection is built in order. First the client sends hello with an ephemeral key share, and the server answers with its own. Next the server proves its name with its certificate. Then a fast symmetric cipher with an integrity check carries the traffic. This is the full TLS1.3 handshake with ephemeral shares: no resumption, no early data. A key share is public; its matching private secret stays hidden and is deleted after use.

**Example.** You type bank dot example but the certificate says mail dot example. The browser stops at the name check. Key shares were already exchanged in hello, but without a passing check no authenticated application data flows.

*(drawing: A wrong computer clock misreads good dates. Certificates carry valid dates, so good sites fail on validity.)*

Forward secrecy comes from ephemeral key shares and erasing secrets after use. Each visit makes fresh shares, uses them, then deletes the ephemeral private secrets and session keys. If the long term signing key leaks later, past visits stay sealed because those secrets are gone.

After the secret is agreed, a fast symmetric cipher with an integrity check carries the traffic. Plain text would waste the secret, so the cipher guards every later message.

*(drawing: The certificate binds the public key to the requested name. Bank against mail differs, so the name check fails first.)*

The key shares were exchanged in hello. Names get checked next at the certificate, and expiry belongs to certificates. A fresh shared secret is the only product here. The server also sends CertificateVerify, proving it holds the certificate private key, and both sides send Finished to confirm the keys before traffic flows.

**Recap.** Share hello and ephemeral key shares first, check the certificate next, then carry the traffic under a cipher that guards secrecy and integrity.

## Practice

8 questions on this page, each with its working shown.

## Needs first

- [Public-Key Cryptography and Key Exchange](https://lightmysky.com/learn/computing/public-key-cryptography-and-key-exchange-mt_AHCtrer4eh)
- [Hashes, Signatures and Certificates](https://lightmysky.com/learn/computing/hashes-signatures-and-certificates-mt_qLHm767U87)

## Optional connections

- [The Web as a Protocol: Requests, State and Caching](https://lightmysky.com/learn/computing/the-web-as-a-protocol-requests-state-and-caching-mt_MDiW4Vt0bo)

## Opens up

- [Threat Modelling: Assets, Adversaries and Trust Boundaries](https://lightmysky.com/learn/computing/threat-modelling-assets-adversaries-and-trust-boundaries-mt_VRXTkrNFvx)