Three layers, one click
A round trip is the time for a packet to reach the server and come back — about 10 ms across a city, 150 ms across the world, and on a bad mobile network 300 ms or more. That number, not bandwidth, is what makes a page feel slow, and it is why the count of round trips matters more than the size of the files.
| Layer | Job | Costs |
|---|---|---|
| TCP | a reliable, ordered byte stream between two machines | 1 round trip (SYN, SYN-ACK, ACK) |
| TLS | encryption, integrity, and proving who the server is | 1 round trip in TLS 1.3, 2 in TLS 1.2 |
| HTTP | the request and the response themselves | 1 round trip |
What the TLS handshake settles
- Who the server is. It presents a certificate chaining up to a root your device already trusts. The name in the certificate has to match the host you asked for.
- What cipher to use. Both sides list what they support and agree on the strongest common option.
- A shared secret, established so that someone recording the traffic cannot derive it afterwards — which is what "forward secrecy" means.
The server needs to know which certificate to present before encryption is set up, so the host name goes in the first message unencrypted. An observer cannot read your request, but they can see which site you connected to. Encrypted Client Hello is the fix, and is still rolling out.
What HTTPS protects, and what it does not
The green padlock has never meant "safe". It means the bytes were not read or altered on the way, and the server is the one the name points to. Everything else is somebody's code.
| Protected | |
|---|---|
| The URL path, query, headers, body, cookies | yes — all of it is inside the encryption |
| The host name | no — SNI and DNS both reveal it |
| The size and timing of what you load | no — an observer sees the shape of the traffic |
| Your data once it reaches the server | not by TLS — that is the server’s problem |
| A malicious site with a valid certificate | not at all — HTTPS says "this is really evil.test" |
Connections are reused
Opening a connection is expensive, so browsers keep them open (Connection: keep-alive, and in HTTP/2 a single connection carries everything for that origin). The handshake cost is paid once per origin, not once per file — which is why a page pulling fonts, scripts and images from six different hosts pays six times.
TLS session resumption makes a repeat handshake cheaper still, and HTTP/3 (over QUIC) merges the transport and crypto handshakes into one round trip.
Counting round trips
DNS 1 round trip (unless cached)
TCP 1 round trip
TLS 1.3 1 round trip
HTTP 1 round trip
────────────────────────
4 × RTT before the first byte of HTML
// then everything from that origin: 1 × RTT each, in parallel