Skip to content
ecdsa.com

ALPN (Application-Layer Protocol Negotiation)

The TLS extension of RFC 7301 in which the client offers application protocols such as h2 and http/1.1 and the server picks one inside the handshake, avoiding an extra round trip.
Also written asApplication-Layer Protocol NegotiationALPNh2acme-tls/1

Registered identifiers include http/1.1, h2 (HTTP/2), h3 (HTTP/3 over QUIC), acme-tls/1 (ACME tls-alpn-01), smtp, imap, dot (DNS over TLS) and postgresql. HTTP/2 over TLS requires ALPN; a server that does not select h2 forces clients back to HTTP/1.1. ALPN also separates protocols sharing one port and blocks cross-protocol attacks such as ALPACA (2021) when servers reject unknown values.

The ALPN list travels in the clear in the ClientHello (unless ECH is used) and is part of TLS fingerprints such as JA4. openssl s_client -alpn h2,http/1.1 shows what a server selects.

Standards and references

All terms