Select one protocol or stop
03The server selects a client-supported protocol; no overlap produces a fatal alert.
Having selected http/1.1, the server must not silently send h2 application data. The illustrative gate stops the inconsistent protocol before use.
Source for this drawing: RFC 7301 · Read RFC section 3.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A server participating in ALPN SHOULD select its own most-preferred protocol that the client also advertised. This recommendation is not a requirement to follow client order.
- A server participating in ALPN SHOULD select its own most-preferred protocol that the client also advertised. This recommendation is not a requirement to follow client order.
- A server MAY return an ALPN selection. If it does, the list MUST contain exactly one name. It ignores protocol names it does not recognize; an unadvertised name is not a valid selection.
- If an ALPN server supports none of the advertised protocols, it SHALL send fatal no_application_protocol, alert120. No application exchange follows that fatal failure.
- The selection SHALL be definitive for the connection until renegotiated under the older TLS model. The server SHALL NOT select one protocol then use another. TLS1.3 has no renegotiation. An absent ALPN response does not itself negotiate a default protocol; any fallback depends on the application specification.
The helper models a server that opted into ALPN and follows the SHOULD server-preference policy. It is not a TLS implementation. The malformed-framing gate in chapter2 and the no-overlap alert here are different failures.
Read the RFC section ↗