TCP handshake
The browser already has 203.0.113.10 from DNS. It opens a TCP connection by sending a SYN segment to port 443.
The server agrees with a SYN-ACK: it acknowledges the browser's sequence number and picks its own.
The browser's ACK completes the three-way handshake, one round trip after the SYN. Nothing is encrypted yet.
TLS 1.3 handshake · 1 round trip
Right behind the ACK, the browser offers TLS 1.3, its cipher suites and a fresh X25519 public key, keeping the private half to itself. It names www.example.com (SNI) and asks for HTTP/2 (ALPN), all in plaintext.
The server picks TLS 1.3 with TLS_AES_128_GCM_SHA256 and answers with its own fresh X25519 public key. This is the last message either side sends in plaintext.
Each side combines its own private key with the other side's public key and gets the same shared secret, which never crosses the wire; HKDF turns it into handshake keys. The key pairs are fresh and thrown away afterwards, so a later theft of the server's certificate key cannot decrypt this recording (forward secrecy).
In the same flight as the ServerHello, the server sends four messages encrypted with its handshake key: EncryptedExtensions, its certificate chain, a CertificateVerify signature over the handshake so far, and Finished.
The browser decrypts the flight and checks the chain: the leaf is signed by the intermediate, the intermediate by a root in its own trust store, the name matches www.example.com, and today is within every validity period.
With the leaf certificate's public key the browser checks the CertificateVerify signature, which proves the server holds the matching private key. It then checks the server's Finished, which proves nobody altered the handshake.
The browser sends its own Finished, encrypted with its handshake key. The TLS handshake took one round trip on top of TCP's.
Encrypted HTTP/2
Both sides now derive application keys from the same secret. Without waiting, the browser sends GET / over HTTP/2, encrypted with AES-128-GCM.
The server answers with the page, encrypted with its own application key. An eavesdropper sees only the IP addresses and ports, the plaintext hellos including the SNI name (unless ECH hides it), and the sizes and timing of records.
The message, field by field
;; step 1/12 · tcp-syn · tcp ;; browser → server ;; t = 0–20 ms (illustrative) TCP 192.0.2.7:51514 → 203.0.113.10:443 flags SYN seq x (random initial sequence number)
Messages sent in the same flight are shown one after another; their times overlap on the clock. On a later visit the browser can resume with a pre-shared key from a NewSessionTicket and even send 0-RTT early data with its first flight; early data can be replayed, so servers accept it only for safe requests.