Glossary
TLS ClientHello
The ClientHello is the first TLS handshake message. It is sent unencrypted and lists versions, cipher suites, extensions, SNI and ALPN offered by the client.
The ClientHello is the first message a client sends in a TLS handshake. It lists the protocol versions, cipher suites, extensions and parameters the client supports, and usually includes the server name (SNI) and the application protocols it wants (ALPN, such as h2 or http/1.1). In TLS 1.3, the real version is negotiated in the supported_versions extension.
Because the ClientHello travels before encryption is established, it stays readable in a capture even when the rest of the session is encrypted, unless Encrypted Client Hello is used. Its structure depends on the client's TLS library and settings, which is the basis of JA3 and JA4 fingerprints, explained in JA3 and JA4 TLS fingerprinting.