Secure Sockets Layer (SSL) Handshake

Here's a nice explanation of the SSL handshake, note if you are using Wireshark to examine a network transaction that you must have the entire handshake from the first packet the client sends to the web server.

Description of the Secure Sockets Layer (SSL) Handshake

The Secure Sockets Layer (SSL) protocol uses a combination of public-key and symmetric-key encryption. Symmetric-key encryption is much faster than public-key encryption; however, public-key encryption provides better authentication techniques. An SSL session always begins with an exchange of messages called the SSL handshake. The handshake allows the server to authenticate itself to the client by using public-key techniques, and then allows the client and the server to cooperate in the creation of symmetric keys used for rapid encryption, decryption, and tamper detection during the session that follows. Optionally, the handshake also allows the client to authenticate itself to the server.