Recently I measured HTTP/3, the newest version of the web’s core protocol, against HTTP/2. There is an older lever on the same traffic worth measuring too: the TLS version underneath it. So I put TLS 1.2 against TLS 1.3 on the same test.
TLS is the encryption layer under HTTPS. Before any encrypted request, the two machines do a short back-and-forth to agree on keys, and that is the handshake. TLS 1.2 takes two round trips: the client and server first negotiate which cipher and key exchange to use, then swap keys in a second round. TLS 1.3 cut that to one. It dropped the old, weak options so there is little left to negotiate, and the client sends its key material in its very first message instead of waiting for the server to pick. One round trip on setup instead of two.
The catch is that most traffic never pays for a fresh setup. A busy client keeps a pool of connections open and reuses them, so the handshake is paid once and then thousands of requests ride the same warm connection for free. On a warm connection there is no handshake to save, and the TLS version stops mattering. The version only matters when a connection is new. Connections do get replaced: they drop, they time out, they get recycled when a system scales up and down. So the real question is how often that happens, and how much each new connection costs depending on the TLS version.
Setup: sender and a receiver far apart, traffic over the public internet, about 100 milliseconds round trip. Then I made a share of the requests land on a brand-new connection, a fresh handshake, and raised that share from zero, running the same traffic over TLS 1.2 and TLS 1.3.
With no fresh connections, the two are identical. As the share of fresh connections rose, the typical request held at the same speed for both, because most requests still ride warm connections. The whole cost landed on the requests that hit a new connection, and there TLS 1.2 ran about a third slower than TLS 1.3. That difference is one full network round trip, the extra handshake leg TLS 1.2 does and TLS 1.3 skips.
One step I did not measure: TLS 1.3 can resume an earlier session and send its data in the very first packet, with no handshake round trips at all (0-RTT). On a repeat connection that would cut the cost to zero. It carries a risk, though. With no round trip to prove the client is really there, anyone who captures that first packet can send it again later, so 0-RTT is only safe for requests that cause no harm if they run twice.
So the TLS version is worth exactly as much as your connection churn. Keep the connections warm and reused, and the newer one buys you almost nothing. Let them churn, and the older one costs a round trip on every fresh connection. And that round trip is only as long as the distance it crosses: sit the sender and the bidder close together and even a fresh handshake is cheap, so the version barely shows there either.
