gen-briefly-explain-tls-handshake-basics-and-one-common-misconce-f3c2

Briefly explain TLS handshake basics and one common misconception about it.

# TLS Handshake Basics The TLS handshake establishes a secure connection between client and server through these key steps: 1. **Client Hello** - Client sends supported TLS versions and cipher suites 2. **Server Hello** - Server chooses protocol version and cipher suite, sends its certificate 3. **Key Exchange** - Both parties establish a shared secret (method varies by cipher suite) 4. **Finished** - Both sides verify the handshake with encrypted messages The result is an encrypted channel with authenticated identity (usually server-side). ## Common Misconception **"TLS encrypts data end-to-end between user and destination server"** This is often false. TLS only encrypts data between **direct connection points**. If you're connecting through: - A corporate proxy - A CDN (like Cloudflare) - A load balancer ...the connection may be **decrypted and re-encrypted** at these intermediaries. They can see your plaintext traffic. True end-to-end encryption requires application-layer encryption (like Signal protocol or PGP), not just TLS. Many users assume HTTPS provides complete privacy, but network administrators, CDN providers, or reverse proxies often have full access to "encrypted" traffic.