TLS Handshake Infographic in Star Network Layout

Tech architecture infographic titled "TLS Handshake" using the PROTOCOL HANDSHAKE archetype, designed for a senior engineer audience. Create a star network layout composition with the central focus on a TLS-enabled API Server, surrounded by labeled component boxes connected by directional arrows: Client Browser, DNS Resolver, Load Balancer / Reverse Proxy, API Server, Certificate Authority, Session Cache, Message Queue, Primary Database, and Generic Cloud Edge. Render each as a clean flat vector box with a simple icon, a canonical English name, and a one-line English role description. Example box text style: "Client Browser — Initiates HTTPS connection and validates server identity", "API Server — Terminates TLS and serves application responses", "Session Cache — Stores resumable session parameters", "Primary Database — Persists application data after secure request processing", "Message Queue — Buffers asynchronous jobs", "Certificate Authority — Issues and signs X.509 certificates", "DNS Resolver — Resolves service hostname to IP address", "Load Balancer / Reverse Proxy — Accepts TCP connections and forwards HTTPS traffic", "Generic Cloud Edge — Public network entry point with generic cloud icon".

Show technically accurate numbered TLS 1.3 handshake exchanges as prominent arrows between Client Browser and API Server, with optional supporting arrows to DNS Resolver and Certificate Authority. Use arrow labels in English such as: "1. DNS query", "A / AAAA record", "2. TCP SYN", "SYN-ACK", "ACK", "3. ClientHello + SNI + ALPN + supported cipher suites + key share", "4. ServerHello + selected cipher suite + key share", "EncryptedExtensions", "Certificate", "CertificateVerify", "Finished", "5. Client Finished", "6. HTTPS GET / JSON request", "HTTP 200 JSON response", "7. Session ticket for resumption". If showing resumed handshake, label it clearly as "Optional TLS resumption" with PSK / session ticket, not as the default full handshake. Do not depict inaccurate TLS 1.3 messages such as ServerKeyExchange or ChangeCipherSpec as required core steps. If a certificate validation helper path is shown, depict it as a trust chain reference or OCSP / CRL check only if labeled as optional.

Include secondary arrows from API Server to Session Cache, Message Queue, and Primary Database to satisfy system context, with labels like "session ticket", "enqueue job", and "SQL query / INSERT row". These should be visually subordinate to the handshake flow. Keep Browser and API Server as the main protocol pair, with all other nodes arranged radially in a star around the center.

Add a numbered legend (1-7) in English explaining the lifecycle: 1. Client resolves hostname and opens TCP connection. 2. Client sends TLS 1.3 ClientHello with SNI, ALPN, supported groups, and key share. 3. Server replies with ServerHello and establishes shared secrets. 4. Server sends encrypted handshake messages including certificate and Finished. 5. Client validates certificate chain, verifies Finished, and sends its Finished. 6. Encrypted HTTPS application data flows over the negotiated TLS session. 7. Server may issue a session ticket to enable faster future resumption. Keep wording precise and avoid any audited or absolute security claims.

Visual style: minimal flat, editorial developer-blog illustration, isometric or flat tech-diagram style, vector-clean infographic layout. Use a developer pink & teal palette with dark slate neutrals, soft off-white background, thin crisp strokes, subtle depth, restrained gradients, high contrast labels, calm precise engineering mood. Prioritize clean hierarchy, balanced spacing, senior-engineer clarity, and protocol-level accuracy. No real cloud-vendor logos; use only generic cloud icons. All text MUST be written in English (array). Every heading, label, caption, legend and metric name in the image must be in English — not English. Spell each English word correctly using English characters and diacritics. Numbers stay as digits, no real cloud-vendor logos (AWS / GCP / Azure) — use generic cloud icons, no watermarks No real cloud-vendor logos (AWS, GCP, Azure) beyond generic cloud icons. Common protocol names (HTTPS, TCP, JWT, OAuth, REST, GraphQL) stay in canonical English form. No security-claim overstatements (do not present diagrams as audited reference architectures).