ServerHello & Encrypted Extensions

Server's response includes:

ServerHello (still cleartext):

• legacy_version (0x0303)
• random (32 bytes)
• legacy_session_id_echo
• cipher_suite (chosen)
• legacy_compression_method (0x00)
• extensions: supported_versions = TLS 1.3, key_share = server's DH pub

After ServerHello, BOTH sides compute the handshake secret:

early_secret = HKDF-Extract(0, PSK or zeros)
hs_secret    = HKDF-Extract(derived_from(early_secret), shared_secret)

And derive handshake traffic keys for each direction.

Everything from here is encrypted with handshake keys.

The server then sends (encrypted):

• EncryptedExtensions: SNI confirmation, ALPN, etc.
• Certificate: server's X.509 cert chain.
• CertificateVerify: signature over the handshake transcript, proving the server has the cert's private key.
• Finished: HMAC over the entire handshake, proving both sides agree on the keys.

Client then replies with its own:

• Finished: same HMAC structure.

After both Finished messages, application traffic keys are derived. From now on, application data flows encrypted.

The TLS 1.3 handshake hides the certificate from passive observers (encrypted before transit). TLS 1.2 sent it cleartext.