Explain how TLS secures a connection

A networking fundamentals question after a coding exercise: explain how TLS sets up a secure connection between a client and a server, and how it protects the data afterwards. Walk through the handshake, how the server proves its identity with a certificate and the chain of trust, how the two sides agree on session keys, and how the record layer gives confidentiality and integrity. Be ready for follow-ups on what changed from TLS 1.2 to 1.3, forward secrecy, and what an attacker in the middle can and cannot do.