How can you identify the TLS protocol version negotiated in a handshake?

• A. Check the TLS record layer version in ClientHello
• B. Check the certificate version
• C. Inspect the ClientHello/ServerHello messages; Wireshark shows the negotiated version (e.g., TLS 1.2, TLS 1.3) in the handshake
• D. Look at the Session ID

Answer: (C)

The version that will be used is determined during the TLS handshake and is communicated in the handshake messages. The client proposes which versions it supports in the ClientHello, and the server selects one and replies with a ServerHello using that version. Wireshark surfaces this as the negotiated protocol version shown in the handshake, such as TLS 1.2 or TLS 1.3. In TLS 1.3, the final choice is also conveyed via the supported_versions mechanism, while the legacy record-layer version fields are kept for compatibility and aren’t always indicative of the actual negotiated version. So, inspecting the ClientHello and ServerHello and reading the negotiated version shown in the handshake is the reliable way to identify the protocol version that was agreed upon.