Engineering Glossary · Transport Security
TLS 1.3: One Round Trip, and None on a Resumed Session
On a 60 ms link, the difference between TLS 1.2 and 1.3 is a whole extra round trip on every cold connection, paid by every first-time visitor.
The short answer
TLS is the cryptographic protocol doing the actual work behind HTTPS — the modern successor to SSL, whose name everyone still uses out of habit.
For anyone measuring page speed, the number that matters is round trips before data flows. A TLS 1.2 full handshake needs two; TLS 1.3 needs one; a resumed session can need none at all. Multiply by the round-trip time to the visitor and you have the real cost, which is why the same configuration change is worth almost nothing on a fast local link and quite a lot for a customer on mobile data.
By the HostingFast team · Reviewed 12 August 2026
0
Jargon left undefined
100+
Entries, all cross-linked
Real
Working examples
Free
To read, always
Every connection opens with a handshake: the certificate is checked, session keys are agreed, and traffic then flows under symmetric encryption because that is far cheaper to run. Versions matter — TLS 1.2 and 1.3 are current, with 1.3 both faster and stricter, and anything older is retired ground that only gives attackers a target.
Its reach goes well past web pages. The same machinery wraps mail submission, APIs and most modern protocols; different ports, identical guarantees at the end of them.
Count the round trips, then multiply by latency
A full TLS 1.2 handshake is two round trips before any application data moves. TLS 1.3 restructures it into one. Session resumption, where the client presents a ticket from a previous visit, can start sending immediately. Those are the three cases, and which one a visitor gets depends on your configuration and on whether they have been before.
The saving is latency multiplied by the number of round trips removed, so it scales with distance rather than with server power. A visitor 60 ms away saves 60 ms moving from 1.2 to 1.3 — invisible on a synthetic test run from the same region, plainly visible in field data from mobile users.
Check what you actually negotiate
openssl s_client -connect example.com:443 -tls1_3 succeeds or it does not, which is the shortest possible test. The browser's Security panel names the negotiated protocol and cipher for the page in front of you, which is useful when you want to confirm what a real client chose rather than what the server is willing to offer.
Do not stop at 'it works'. A server can offer 1.3 and still complete most handshakes at 1.2 because of an ordering preference or an old configuration snippet, and a public scanner that grades the endpoint will show you the full list of what is enabled — including the protocol version you thought you disabled two years ago.
Old versions are a liability, not a compatibility feature
TLS 1.0 and 1.1 are retired. Leaving them enabled does not help anyone connect, because current clients will not use them, and it does give a compliance scan something to flag and an attacker something to try. The same goes for cipher suites kept around for a browser nobody has run since 2016.
On managed hosting this is our problem: versions stay current and the cipher list stays sensible as part of the platform. On a VPS it becomes a line you own in the nginx or Apache configuration, where the distribution's modern defaults are a good starting point and a public grade is the check that you did not drift from them.
Where this lands on HostingFast
Shared plans get current TLS maintained for them, and VPS customers get root access to configure it themselves — including on mail submission and any API endpoint on the same box. The rate you sign up at is the rate you renew at, so year two costs exactly what year one did.
Read next: SSL Certificate for the credential the handshake validates, HTTPS for what runs on top, Encryption for the mathematics, and SMTP for the other place this protocol shows up.
Definitions written for people who deploy
To us, jargon nobody explained is a service defect. This glossary is the support team's collected translations — published with the openssl commands, the version numbers and the round-trip counts still in them.
Order an annual plan and the first year of your domain registration costs you nothing.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Round trips counted
Two, one or none — the handshake cost is stated as hops, then multiplied by the latency your visitors actually have.
Field data over lab data
Where a change only shows up for distant visitors, the entry says so, rather than pointing at a same-region test.
Commands you can paste
openssl s_client with an explicit version flag answers in one line what a settings page only implies.
Ownership made explicit
Which parts we maintain on shared hosting and which become yours on a VPS, stated rather than assumed.
Wired to its neighbours
TLS runs into SSL Certificate, HTTPS and SMTP — the credential, the web layer and the other protocol it wraps.
This term, landed
TLS defined, its versions counted in round trips and its negotiation verified — enough to grade your own endpoint.
Quick Start
From order to online
- 1
Test the version explicitly
openssl s_client -connect example.com:443 -tls1_3. It either negotiates or it does not, which is faster than reading a configuration file.
- 2
Confirm what real clients choose
The browser Security panel names the protocol and cipher actually used. Offering 1.3 and negotiating 1.2 is a common and invisible gap.
- 3
Grade the endpoint and prune
Run a public scanner, then remove retired versions and legacy ciphers. Nothing current needs them and every scan will flag them.
Built In
Loaded onto every plan
- Current TLS maintained for you on shared and managed plans
- Root access on VPS if you would rather own the configuration
- Free SSL on every plan, renewed automatically before it can lapse
- Browser webmail plus IMAP, POP and SMTP for any mail client
- cPanel, so certificate and PHP settings sit on screens you know
- 99.9% uptime as the target, monitored around the clock
- Daily backups with self-service restores you run yourself from the panel
- Upgrades applied in place — changing plan is not a migration
- WordPress Toolkit handling core and plugin updates for you
- A renewal price identical to the one you signed up at
Frequently Asked
What people ask us most often
How many round trips does a TLS handshake actually take?
Two for a full TLS 1.2 handshake, one for TLS 1.3, and potentially none when a client resumes an earlier session with a ticket. Multiply the difference by the round-trip time to your visitor: 60 ms away, moving from 1.2 to 1.3 saves 60 ms on every cold connection. That is invisible on a test run from the same city and clearly visible in mobile field data.
How do I check which version my site negotiates?
openssl s_client -connect example.com:443 -tls1_3 gives a yes or no in one line. For what real clients pick, the browser's Security panel names the negotiated protocol and cipher for the page in front of you. The two answers can differ, because a server that offers 1.3 may still complete most handshakes at 1.2 through an ordering preference.
Who maintains the cipher list — you or me?
On shared and managed plans, us: keeping versions current and ciphers sensible is part of the platform. On a VPS you have root, so it becomes a line you own in the nginx or Apache configuration. The distribution defaults are a sound starting point, and a public endpoint grade is how you confirm you have not drifted from them.
Why do certificates still say SSL?
Habit and product naming. The genuine SSL protocols were retired years ago and no current software will negotiate them — every connection you make is TLS. The acronym survives on invoices and product pages because that is what buyers search for, but nothing in the handshake has been SSL for a very long time.
Keep reading
SSL Certificate
The credential the handshake validates, and the chain that decides whether validation succeeds.
HTTPS
What sits on top, and the redirect chain that gives back the round trips this layer saved.
Best Hosting With Imunify360 Security
A shortlist with the reasoning shown — the checks that matter and the one trap most buyers walk into.
CMS Hosting
Fast, hardened hosting for WordPress, Joomla, Drupal and every major CMS.
VPS Hosting
KVM virtual servers — root access, DDoS filtering and one flat monthly price.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Fewer round trips, same page.
Current TLS maintained for you, free SSL on every plan, and root access on VPS when you want the configuration yourself.
View CMS Hosting plans