.
The answer is both. You will find a nice explanation in 4 steps from digicert.com below:
.
- Server sends a copy of its asymmetric public key.
- Browser creates a symmetric session key and encrypts it with the server's asymmetric public key. Then sends it to the server.
- Server decrypts the encrypted session key using its asymmetric private key to get the symmetric session key.
- Server and Browser now encrypt and decrypt all transmitted data with the symmetric session key. This allows for a secure channel because
only the browser and the server know the symmetric session key, and
the session key is only used for that session. If the browser was to
connect to the same server the next day, a new session key would be
created.
https://www.digicert.com/ssl-cryptography.htm
