Start free trial

Glossary · Domains, DNS, email and certificates

What is a TLS handshake?

The TLS handshake is the exchange at the start of an HTTPS connection in which the client and server agree on a TLS version and cipher, the server proves its identity with its certificate, and both derive the keys that encrypt the rest of the connection.

How it works and why it matters

In TLS 1.3 the client sends a ClientHello with the name of the site (SNI), the ciphers it supports and a key share. The server answers with its choice, its certificate and a signature, and the client checks the certificate chain, the name and the dates. That takes one round trip; TLS 1.2 needs two.

The handshake is its own part of response time: about one round trip of latency plus the server’s work. Reused connections and session resumption skip most of it, which is why a monitor that opens a fresh connection for every check sees more TLS time than a browser on its second page.

Handshakes fail for a few reasons: an expired or wrong certificate, a missing intermediate certificate, no certificate for the requested name, a server that offers only old versions (TLS 1.0 and 1.1 are deprecated by RFC 8996), or a port that answers in plain HTTP. Browsers show these as security errors; for monitoring, they are downtime.

Formula

TLS time ≈ round trips × round-trip time + server processing

Example: With 30 ms to the server, a TLS 1.3 handshake takes about 30 ms plus the server’s work, and a TLS 1.2 handshake about 60 ms.

How Uptimecheck helps

Every HTTPS check in Uptimecheck opens a new connection, so it includes a full handshake, and response times show the TLS handshake as its own phase next to DNS, connect, server and download. Check details show the TLS version and the certificate’s name and issuer. When a handshake fails, the incident says what it probably means: no certificate for the name, only old TLS versions or ciphers, plain HTTP on the HTTPS port, an untrusted or incomplete chain, or a handshake that didn’t finish before the timeout.

See SSL monitoring

Set it up How to monitor SSL certificate expiry Why a monitor is down when your site works
Start free trial Try the live demo

14-day free trial · No credit card required

Read more in the guides

Guides 7 min read

SSL Certificate Errors Explained: Causes and Fixes

NET::ERR_CERT_DATE_INVALID, ERR_CERT_COMMON_NAME_INVALID and the other browser SSL warnings explained: what each one means, what causes it and how to fix it on your server.

Read

Monitoring 7 min read

What Is a Good Website Response Time?

Response time is how long your server takes to answer a request, not how long the page takes to load. What counts as good, why monitors and browsers measure differently, and what slows sites down.

Read

Questions

How long does a TLS handshake take?

About one round trip for TLS 1.3 and two for TLS 1.2, plus the server’s processing: often 20 to 100 ms to a server in the same region. Much more points at a slow or distant server, or at a certificate chain the client has to complete itself.

What is SNI?

Server Name Indication: the client names the site it wants in its first handshake message, so one IP address can serve many sites with different certificates. Without a matching name the server may refuse the handshake.

What causes an SSL handshake failed error?

Most often an expired, wrong or incomplete certificate, a server that only offers TLS versions or ciphers the client refuses, or a proxy or firewall that breaks the connection. An SSL checker shows which part fails.

More from Domains, DNS, email and certificates

All terms

Downtime is obsolete.

Set up your first monitor in under a minute, or look around the live demo first.

Start free trial Compare plans

14-day free trial · No credit card required