Read the nested lengths
02The extension contains a two-octet list length and one-octet lengths for individual protocol names.
An empty name or missing declared name byte does not form a valid ProtocolNameList. The illustration does not invent a particular TLS alert for these malformed examples.
Source for this drawing: RFC 7301 · Read RFC section 3.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Fields are schematic, not drawn to byte scale. ExtensionType16 is 00 10. The outer TLS extension_data length and inner protocol list length each use two octets; a protocol-name length uses one octet.
- Fields are schematic, not drawn to byte scale. ExtensionType16 is 00 10. The outer TLS extension_data length and inner protocol list length each use two octets; a protocol-name length uses one octet.
- For [h2, http/1.1], name entries occupy3 +9 =12octets. The list prefix adds2, making14octets of extension_data. The four-octet extension header is outside that14.
- A server selection uses the same structure but MUST contain exactly one name. Selecting h2 gives3list octets,5extension_data octets and9octets including the extension header.
- Name lengths are1–255octets and empty names MUST NOT appear. Names MUST NOT be truncated. The list vector and its enclosing TLS extension have separate bounds; framing checks do not establish IANA registration or protocol support.
ProtocolNameList permits2–65535payload octets. When wrapped in the TLS extension_data vector, its two-octet list prefix also has to fit the outer65535-octet bound (TLS1.3 RFC9846 §4.3). The helper validates these two component layers, not a full ClientHello. A complete handshake adds enclosing-vector bounds and other extensions.
Read the RFC section ↗