One round trip
TLS 1.3 gets from nothing to encrypted data in a single round trip.
Your client opens by listing the ciphers it supports and, optimistically, including a fresh key share. Your server answers with its own key share, its certificate, and a signature proving it holds that certificate's private key.
Watch what happens next, because it is the clever part. Both sides combine the two key shares to derive identical secret keys, and those keys never cross the wire at all. Your client checks the chain and the signature, says it is finished, and the very next bytes are encrypted HTTP.
The division of labour
Memorise the division of labour, because interviewers ask. The expensive asymmetric cryptography runs only during the handshake, since it costs vastly more processor time per byte.
Everything after runs on symmetric ciphers that modern processors accelerate in hardware at gigabytes a second.
Those key shares are generated per connection and thrown away, which buys you forward secrecy by construction. Someone recording your traffic today and stealing your certificate key next year still cannot decrypt the recording.
Get repeat connections cheaper still. Resumption lets a returning client present a ticket from last time and skip transferring and verifying the certificate entirely.
Go one step further with zero round trip data, where your client sends application data in its very first flight. Know the catch before you enable it: that data can be replayed by anyone who captured it, so it is only safe for requests that are harmless to repeat.
Worked example
Meera runs the mobile API for a food delivery app whose customers are mostly on Indian 4G with 150 ms round trips to her Mumbai region. Traces show a cold API call burns 450 ms before the request even leaves: one round trip for TCP, two more for the TLS 1.2 handshake. She moves the fleet to TLS 1.3, which cuts the handshake to one round trip and saves 150 ms on every cold connection, then enables session tickets so follow-up connections resume without repeating certificate verification. Time to first byte at p95, the number the slowest one request in twenty comes in under, falls from 720 ms to 430 ms with zero application changes. Her writeup for the team: on high-latency networks, handshake round trips dominate, so the protocol version is a performance decision, not just a security one.