TLS Session Keys

Thousands of users connect to the same server. They may all see the same server certificate and public key. Each connection needs its own secret encryption keys.

In a typical modern TLS handshake, keys have two jobs: Identity: the server signs the handshake with its long-term private key; the client verifies the signature using the certificate's public key. Key agreement: both sides generate fresh temporary key pairs and exchange their public keys.

Client private key + Server public key → shared secret
Server private key + Client public key → same shared secret

Here, all four keys are temporary. Both sides derive matching symmetric traffic keys from the shared secret and handshake data: one key per direction, used to encrypt by the sender and decrypt by the receiver.

Connection 1 ↔ Server → keys A
Connection 2 ↔ Server → keys B
Connection 3 ↔ Server → keys C

These connections can all come from the same browser. Multiple requests can share one connection and its keys. The connection lasts only as long as all participants keep it open. TLS itself sets no universal connection duration.