Understanding Multiple Handshake Messages in TLS
I assume you mean “when will Multiple Handshake Messages appear?”
That simply indicates that multiple TLS handshake messages (server_hello
and certificate
in this case) showed up in the same packet.
Wireshark puts that there to indicate to you, the viewer, that there are multiple distinct handshake messages to be reviewed. It is to prevent you from looking at the top of the packet, saying “Oh, I don’t care about server_hello
, I’m going to keep looking at the next packet to find the certificate
“ without realizing they’re both there.
Put differently, “Multiple Handshake Messages” isn’t a TLS message type, it doesn’t correspond to any bit set in the TLS packet itself, it’s meta-information – a conclusion about the packet – being noted by the tool displaying the packet.