1 ALPN: Application Layer Protocol Negotiation

ALPN is the newer and preferred extension for TLS, standardized in RFC 7301 in 2014. It allows the client to indicate a list of supported application layer protocols in the ClientHello message, and the server to select one of them in the ServerHello message. This way, the application layer protocol can be determined before the TLS handshake is finished, saving one round trip time (RTT) and improving performance. ALPN also supports encrypted SNI (ESNI), which protects the server name from being revealed to network observers. ALPN is widely supported by modern browsers and servers, and is required for HTTP/2 and HTTP/3.

2 NPN: Next Protocol Negotiation

NPN is the older and deprecated extension for TLS, proposed by Google in 2012 as a draft. It allows the server to indicate a list of supported application layer protocols in the TLS handshake, and the client to choose one of them after the handshake is completed. This way, the application layer protocol can be determined after the TLS handshake, adding one RTT and reducing performance. NPN does not support ESNI, which exposes the server name to network observers. NPN is not standardized and is only supported by some browsers and servers, mainly for backward compatibility. It is not recommended for HTTP/2 and HTTP/3.

3 Advantages of ALPN over NPN

The main advantages of ALPN over NPN are its speed, security, reliability, and future-proofing. ALPN reduces latency by one RTT, supports ESNI to prevent protocol downgrade attacks, avoids the risk of mismatch or failure in protocol negotiation, and is standardized and required for newer protocols like HTTP/2 and HTTP/3.

4 Disadvantages of ALPN over NPN

ALPN has several drawbacks compared to NPN. It requires more client-side configuration, as the client must specify the list of supported protocols beforehand. Additionally, ALPN may not be compatible with older browsers or servers that only support NPN, leading to connection errors or fallbacks to less optimal protocols. Furthermore, ALPN may not be able to negotiate some non-standard or proprietary protocols that are not registered with IANA, which could limit the flexibility or functionality of some applications.

5 How to implement ALPN in your web server

To implement ALPN in your web server, you need to first ensure that you have a valid TLS certificate for your domain name, and that your web server supports TLS 1.2 or higher. You should then enable ALPN in your web server configuration, and specify the list of supported application layer protocols such as h2 for HTTP/2 or h3 for HTTP/3. Lastly, test your web server with a tool like SSL Labs or curl to verify that ALPN is working correctly and that your preferred protocol is selected.

6 How to implement NPN in your web server

To implement NPN in your web server, you must first ensure that you have a valid TLS certificate for your domain name and that your web server supports TLS 1.1 or higher. Next, enable NPN in your web server configuration and specify the list of supported application layer protocols, such as spdy for SPDY or http/1.1 for HTTP/1.1. Finally, test your web server with a tool like SSL Labs or curl and verify that NPN is working correctly and that your preferred protocol is chosen. This will ensure that you are able to successfully implement NPN in your web server.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?