I find that the best way to learn it is to start poking at it. Fire up Wireshark, load google.com, and take a close look at the traffic. You'll see every packet

I find that the best way to learn it is to start poking at it. Fire up Wireshark, load google.com, and take a close look at the traffic. You'll see every packet going back and forth, and can try to figure out what each one of them is. Set up a proxy that can MITM the SSL connection, and look at the contents of the packets. Just setting that up will probably tell you a lot about how it all works, and you'll be in a better position to see the plaintexts of all of the handshaking traffic.