Which display filter shows TLS certificate handshake messages?

• A. tls.alert.type == 11
• B. tls.handshake.type == 11
• C. tls.handshake.version == 1.0
• D. tls.session_id_present == true

Answer: (B)

TLS handshake messages carry a numeric type field, and the Certificate message is type 11. Filtering with tls.handshake.type == 11 shows exactly those handshake messages that carry certificate data, including the server’s certificate chain during the handshake. The other filters don’t target the certificate content: one looks at alert messages, another at the protocol version used in the handshake, and the last checks whether a session ID is present, which isn’t about the certificate messages themselves.