HTTP(S) is stateless, right? But if I go to some site via HTTPS, I assume I don't need an SSL handshake for every single page request. Is it a combination of SSL session cache and cookies?
A SSL session spans several SSL connections (e.g. TCP connections which got upgraded to SSL) and their lifetime is determined by the servers SSL stack. It is usually not directly related to the user session which is determined by the web application and spawns several HTTP requests. These multiple HTTP requests can be sent inside SSL connection (which might have the same SSL session but does not need to) or TCP session without SSL or both. User sessions are usually maintained with HTTP level cookies, while SSL sessions have a similar mechanism, but bound to the SSL protocol.