Glossary · Security

ALPN (Application-Layer Protocol Negotiation)

ALPN is a TLS extension that lets client and server agree on the application protocol, such as h2 or http/1.1, during the handshake.

Updated October 14, 2026

Application-Layer Protocol Negotiation (ALPN) is a TLS extension that lets the client and server choose which protocol will run inside the encrypted connection while the handshake is still in progress. The client offers a list of identifiers and the server replies with one.

Why it matters

ALPN is how browsers learn that a server supports HTTP/2 without an extra round trip. The client offers h2 and http/1.1; if the server selects h2, the first request is already sent over HTTP/2. HTTP/3 over QUIC uses the identifier h3 in the same way.

If ALPN is not configured, or a proxy or TLS terminator in front does not support it, clients quietly fall back to HTTP/1.1. The site still works, but multiplexing and header compression are lost, so the problem often goes unnoticed.

Example

openssl s_client -connect example.com:443 -alpn h2,http/1.1 </dev/null 2>/dev/null | grep "ALPN"

The output ALPN protocol: h2 confirms negotiation. In nginx, listening with listen 443 ssl http2; (or http2 on; in newer versions) enables it.

Common mistakes

  • Enabling HTTP/2 but terminating TLS on an old proxy that lacks ALPN support.
  • Checking with a tool that never offers h2.
  • Expecting ALPN to work for plain-text HTTP.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityOCSP StaplingOCSP stapling lets your server attach a recent, CA-signed revocation status to the TLS handshake so browsers need not query the certificate authority.Glossary · SecurityTLS 1.3TLS 1.3 is the current major version of the TLS protocol, with a faster one-round-trip handshake and only modern, forward-secret cryptography.Glossary · Security0-RTT (TLS Early Data)0-RTT lets a returning TLS 1.3 client send application data in its first flight, saving a round trip but exposing that data to replay attacks.Error fix · Browser errorsERR_CONNECTION_RESET: What It Means and How to Fix ItChrome's ERR_CONNECTION_RESET means the connection was cut mid-way. Try visitor fixes first, then trace resets from firewalls, proxies and app crashes.4 min readError fix · Browser errorsERR_SSL_VERSION_OR_CIPHER_MISMATCH: Fix TLS Protocol and Cipher ErrorsThe server and browser share no TLS version or cipher. Update nginx or Apache to TLS 1.2/1.3, and test protocols and ciphers with openssl and nmap.4 min readError fix · Developer errorscurl (35) SSL connect error: What Each Variant Meanscurl exit code 35 is a generic TLS handshake failure. Read the OpenSSL text after it to separate protocol, cipher, reset and wrong-port causes.4 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.