FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

What is ALPN? ​

Short answer

ALPN (Application-Layer Protocol Negotiation) is the TLS extension that makes it possible to agree during the TLS handshake on which application protocol will be used on the connection (RFC 7301): the client lists the protocols it supports (e.g. h2, http/1.1) in the ClientHello, and the server selects one; thus whether HTTP/2 will be used is determined without an extra round trip. In TR7, on the vService side ALPN is performed automatically according to the frontend Protocol selection (if HTTP/2 is selected, h2 and http/1.1 are offered); on the Backend Service side, when HTTP 2.0 enabled is selected in the ALPN field, TR7 proposes h2,http/1.1 to the server.

Where It Is Used in TR7 ​

WhereField / labelWhat for
HTTP vService → FrontendProtocol: HTTP/1.1, HTTP/2 (and the options with the HTTP/3 badge)With HTTP/2, h2 and http/1.1 are offered with ALPN, and with HTTP/1.1 only http/1.1; with the options with the HTTP/3 badge, h3 is offered on the QUIC connection
Backend Service → SSL ServiceALPN: HTTP 2.0 disabled (default), HTTP 2.0 enabledWhether TR7 proposes HTTP/2 when it connects to the Backend Service with TLS
Load Balancer → Actions (Policy Actions)Keep Header NamesOn the vService to which this action is attached, HTTP/2 and HTTP/3 are disabled; only http/1.1 is offered in ALPN

Common Misconceptions ​

  • "ALPN forces HTTP/2." ALPN only provides the negotiation; if the other side does not support h2, HTTP/1.1 is used.
  • "ALPN also works on an unencrypted connection." ALPN is a TLS extension; likewise, the ALPN field on the Backend Service is visible only while SSL Service is on.
  • "If the vService is HTTP/2, the Backend Service also talks HTTP/2." The two sides are negotiated separately; on the Backend Service connection, for HTTP/2 over TLS, ALPN = HTTP 2.0 enabled is selected and the server must support HTTP/2 over TLS; on an unencrypted connection there is no ALPN, and for HTTP/2, Cleartext HTTP/2 (h2c) is checked.

How it is done in the documentation

Related questions