Use the actual alternative-service port
05An alternative service may answer an origin on a different network port. The first ORIGIN uses the actual connection port when it builds the initial origin.
A subsequent Alt-Svc advertisement for a different endpoint does not add or remove Origin Set members. The two existing members remain; no 9443 origin is automatically inserted.
Source for this drawing: RFC 8336 · Read RFC section 2.3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The intended origin may need an explicit entry even after the connection has served it.
- In this example, requests target https://menu.example (port 443), while the h2 alternative service is reached on port 8443. SNI still names menu.example.
- After the first accepted ORIGIN, the initial origin is https://menu.example:8443. It does not by itself cover https://menu.example.
- The server needs to explicitly advertise https://menu.example in ORIGIN to include that intended origin. Appropriate authority/certificate checks still apply.
- An Alt-Svc advertisement does not modify the Origin Set or establish authority. The two mechanisms have different effects.
This follows the alternative-service example in RFC 8336 § 2.3 and the separation in § 2.4; RFC 7838 is a source companion, not a claimed update edge. Offline fictional examples only. The illustrations assume certificate-check results; they do not perform those checks. MUST, SHOULD and MAY retain their RFC meanings; SHOULD exceptions require carefully weighing the implications.
Read the RFC section ↗