HTTPS clearly explained in 7 minutes

Note: "client encrypts a session key with the server's public key" step is the exact part TLS 1.3 removed. It's called RSA key transport, and it got dropped for ephemeral Diffie-Hellman (ECDHE). The reason is forward secrecy. Under RSA, an attacker records your encrypted traffic today, steals the server's private key a year later, and decrypts all of it retroactively. Ephemeral DH uses a throwaway key pair per session, so a stolen key reveals nothing about past traffic. The private key still signs the handshake to prove identity. It just no longer unlocks the conversation.

Detailed explanation

Extremely helpful visualizer & explaining. Thanks, Alex!

7 menit doang cukup jelas?

learned a lot from bytebytego