What does the Change Cipher Spec message signal in the TLS handshake?
"From this point on, my outgoing messages will be encrypted with the freshly negotiated keys." It's the switch-flip from plaintext handshake to encrypted application data.
Where it appears:
In TLS 1.2:
Client → Server: ClientHello
Server → Client: ServerHello, Certificate, ServerKeyExchange, ServerHelloDone
Client → Server: ClientKeyExchange
Client → Server: ChangeCipherSpec ← "now I'm encrypting"
Client → Server: Finished (encrypted)
Server → Client: ChangeCipherSpec ← "I'm also encrypting now"
Server → Client: Finished (encrypted)
─── now app data ───
Both sides send their own:
The client and server each send their own ChangeCipherSpec independently — each is announcing about their own outgoing direction. Until both have switched, the connection is half-encrypted.
Why it's a separate message:
Historically (TLS 1.0/1.2), ChangeCipherSpec is technically a different protocol (Content Type 20) from regular handshake messages (Content Type 22). It was kept simple — just "switch keys now" — to make the cipher-switch atomic.
TLS 1.3 simplified this:
TLS 1.3 (2018) eliminated explicit ChangeCipherSpec for security reasons — it's now legacy. Most TLS 1.3 implementations send a dummy CCS for middlebox compatibility (some old proxies break without it).
The Finished message:
Right after CCS, both sides send Finished, which is encrypted and contains a hash of all previous handshake messages. This serves as handshake integrity proof — if any earlier message was tampered with, the hashes won't match and the connection is aborted.
Why this all matters:
The handshake itself happens in plaintext (you can see ClientHello, ServerHello, certificates in Wireshark). Only after ChangeCipherSpec does the actual data become unreadable to observers.
Tip: When debugging TLS, the boundary between visible handshake and encrypted "Application Data" packets is the ChangeCipherSpec. Anything you see beyond that is just noise unless you have keys (use SSLKEYLOGFILE for in-browser debug).
Go deeper:
Transport Layer Security (Wikipedia) — the ChangeCipherSpec/Finished boundary and its TLS 1.3 legacy status.- RFC 5246 — TLS 1.2 — where ChangeCipherSpec and Finished are still defined.