How can you identify a TLS Finished message in the handshake?

• A. The Finished message marks the end of the TLS handshake.
• B. The ClientHello marks the end of the TLS handshake.
• C. The Certificate message marks the end of the TLS handshake.
• D. The ServerHello marks the end of the TLS handshake.

Answer: (A)

In TLS, the Finished message is the handshake’s final integrity check. After the key exchange and authentication steps, each side sends a Finished message that contains verify_data derived from all prior handshake messages and the negotiated master secret. This data proves both sides have the same master secret and that no handshake messages were tampered with. Seeing a Finished message means that party has completed its part of the handshake, and the connection is ready to switch to encrypted application data. The handshake as a whole is considered complete once both sides have exchanged their Finished messages.

The other messages occur earlier in the process: ClientHello starts the handshake, ServerHello negotiates version and parameters, and Certificate communicates identity (server or client) but does not indicate the end of the handshake.