This question already has an answer here:

As a Web Developer I recently realised my understanding of HTTPS is poor and am currently endeavouring to better understand it.

After some initial reading I'm left a bit puzzled as to why initially asymmetric private/public key cryptography is used but only as a means to exchange a symmetric key.

Why do the client and server not, once the client has verified the server's certificate and has its public key, just exchange data encrypted with each other's public key?

I realise this is probably a naive question!

marked as duplicate by Gilles, Jens Erat, TildalWave, Mark, schroeder Jan 4 '15 at 0:58

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Browse other questions tagged or ask your own question.