Archivetls
ALPN: Negotiating Protocols Inside TLS
One port, many protocols. ALPN is how HTTP/2, HTTP/3, and custom RPCs coexist without a second handshake.
- Published
- Reading time
- 1 min read
Application-Layer Protocol Negotiation lets the client list protocols in the ClientHello and the server pick one. It replaced the fragile practice of port-based protocol guessing (NPN was the abandoned predecessor).
How it behaves
- Client sends
["h2", "http/1.1"]. - Server selects one and returns it in the ServerHello.
- If there is no overlap, the connection fails — no fallback outside the list.
TLS 1.3 encrypts the server's ALPN selection, which is one reason middleboxes that assumed plaintext broke.
Design lessons
- Order the client list by preference; servers should honor it or document their policy.
- Unknown protocol names must fail closed, not default to HTTP/1.1.
- ALPN is not authentication; a server can claim
h2and speak something else.
Takeaway: ALPN is cheap and standard. Use it instead of custom ports or magic bytes for protocol selection.