After looking at many explanations about the TLS handshake I noticed that sometimes the server starts with the change cipher spec command and sometimes the client starts with it.

I'm wondering why. Is it due to the type of key exchange protocol? Like if it's DFH the server starts and if it's RSA the client starts?

1 Answer 1


From SSL 3 through TLS 1.2 if a full handshake is done (resumption is not used), client does CCS after sending ClientKX (and CertVerify if used) while server responds CCS after receiving ClientKX (and CertVerify), so client is first. Assuming you meant [EC]DHE versus plain-RSA key-exchange, that has no effect -- ClientKX exists in both cases, although its content differs; see https://datatracker.ietf.org/doc/html/rfc5246#page-36 . If resumption is used (i.e. both offered and accepted) producing an abbreviated handshake, server does CCS immediately after ServerHello, and then client responds; see https://datatracker.ietf.org/doc/html/rfc5246#page-37 .

For TLS 1.3 CCS is not required and specified only as an Appendix https://datatracker.ietf.org/doc/html/rfc8446#appendix-D.4 but if used (which IME most implementations do) it should be in the same places as for earlier protocols using resumption, namely server after sending ServerHello but before EncryptedExtensions and then client in response; for a combined example see https://tls13.xargs.org/ (formerly https://tls13.ulfheim.net).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .