A TLS 1.3 handshake completes in one round trip. State what each of the client hello, server hello and the server's certificate and finished messages establishes, then explain what certificate pinning adds and the specific failure a pinned client must be designed for.

A TLS 1.3 handshake completes in one round trip. State what each of the client hello, server hello and the server's certificate and finished messages establishes, then explain what certificate pinning adds and the specific failure a pinned client must be designed for.

Approach: Track three separate goals through the message flow, namely agreeing a shared secret, authenticating the server, and binding the transcript, and say which message achieves which.

The client hello carries the client's ephemeral public key and supported parameters, the server hello returns the server's ephemeral key so both sides derive the shared secret, the certificate and its signature authenticate the server and bind it to that ephemeral key, and finished proves both sides saw the same transcript. Because the ephemeral key exchange values are discarded after the session, later compromise of the server's long-term private key does not decrypt recorded traffic, which is forward secrecy, and the long-term key only ever signs. The certificate chain runs from the server's certificate through intermediates to a root the client already trusts, each link a signature over the next public key and name. The finished message is a MAC over the whole handshake transcript, so transcript binding detects any downgrade or modification of the earlier messages before application data flows. Pinning checks that the presented certificate or public key matches a specific expected value, removing the risk that any trusted root issues a fraudulent certificate for your domain. The failure a pinned client must be designed for is rotation: when the pinned key is replaced or expires, every pinned client refuses to connect and the outage cannot be fixed from the server. Pin a backup key alongside the live one and ship the pin set with an expiry and a recovery path.

Follow-up: TLS 1.3 offers a zero round trip mode for resumed sessions. What property does the early data lose and which requests may never be sent in it?

Key concepts: ephemeral key exchange, forward secrecy, certificate chain, transcript binding.