Server sends a copy of its asymmetric public key to browser.

    Browser creates a symmetric session key and encrypts it with the server’s assymmetric public key then sends it to the server.

    Server decrypts the encrypted session key using its asymmetric private key to get the symmetric session key.

    Server and browser now encrypt and decrypt all transmitted data with the symmetric session key. This allows for a secure channel because only the browser and the server know the symmetric session key, and the session key is only used for that specific session. If the browser was to connect to the same server the next day, a new session key would be created.