TLS encrypts communication to protect it. The client and server first agree on a cipher suite, and the server sends its certificate. That certificate is issued and signed by a trusted third party called a CA (certificate authority). Because the client already holds the CA's public key, it can verify the signature and confirm the other side is genuine. A key exchange then derives a shared key, and all further communication is encrypted with it. This whole exchange, before encrypted communication begins, is the TLS handshake.