-1

While testing SSL/TLS details on ssllabs.com for a website, the Handshake Simulation part contains:

TLS 1.2 > http/1.1
TLS 1.2 > h2

For eg: enter image description here

What do these things mean? I couldn't find it anywhere.

0

2 Answers 2

1

TLS 1.2 > http/1.1

TLS 1.2 > h2

...

What do these things mean?

Both indicate that TLS 1.2 was supported. One indicates that the underlying HTTP protocol was HTTP/1.1, and the other indicates that the underlying HTTP protocol was HTTP/2.

1
  • And for all other clients, can we assume that http 1.0 was used? If yes, is it also safe to assume that that is the max http version that client supports? Would it also be true for clients with http 1.1 ? Mar 27, 2019 at 4:48
1

TLS has two extensions, NPN and ALPN (spec), which allow the client to say that it wants to use something other than plain HTTP/1.1 when it finishes handshaking. NPN is older and was deprecated in favor of ALPN.

The recommended way to use HTTP2 over TLS is to ask for it using ALPN and get a reply from the server that you can use it, and then you can immediately use it instead of starting with HTTP/1.1 and upgrading.

The Qualys test displays what upgrades the server allowed, after the client asked for whatever each simulated client asks.

If the client doesn't ask anything using ALPN, your server doesn't reply with ALPN. The Qualys test then displays nothing about it.

So if the client asks for "HTTP/2, or if that is not supported then HTTP/1.1" and the server sent back "use HTTP/2", you'll see TLS1.2 > h2.

If the client asked for "SPDY or if that is not supported then HTTP/1.1", your server will reply with "use HTTP/1.1". You'll see TLS1.2 > http/1.1.

4
  • And for all other clients, can we assume that http 1.0 was used? If yes, is it also safe to assume that that is the max http version that client supports?Would it also be true for clients with http 1.1 ? Mar 27, 2019 at 4:48
  • TLS 1.0 was used when it says TLS 1.0, yes because that's the best the client supports. MSIE8 on Windows XP used http 1.1 over TLS 1.0. The recommend modern configuration would make it unable to connect.
    – Z.T.
    Mar 27, 2019 at 10:20
  • My question was regarding http 1.0, not TLS 1.0. Basically what I want to know is, in the cases where only TLS 1.2 is written , was http 1.0 used and is it because that's the max http version the client supports? Any thoughts on this? Mar 27, 2019 at 16:25
  • A client that supports TLS 1.0 from 1999 also supports http 1.1 from 1997.
    – Z.T.
    Mar 27, 2019 at 17:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .