While testing SSL/TLS details on ssllabs.com for a website, the Handshake Simulation part contains:
TLS 1.2 > http/1.1
TLS 1.2 > h2
What do these things mean? I couldn't find it anywhere.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
TLS has two extensions, NPN and ALPN (spec), which allow the client to say that it wants to use something other than plain HTTP/1.1 when it finishes handshaking. NPN is older and was deprecated in favor of ALPN.
The recommended way to use HTTP2 over TLS is to ask for it using ALPN and get a reply from the server that you can use it, and then you can immediately use it instead of starting with HTTP/1.1 and upgrading.
The Qualys test displays what upgrades the server allowed, after the client asked for whatever each simulated client asks.
If the client doesn't ask anything using ALPN, your server doesn't reply with ALPN. The Qualys test then displays nothing about it.
So if the client asks for "HTTP/2, or if that is not supported then HTTP/1.1" and the server sent back "use HTTP/2", you'll see
TLS1.2 > h2.
If the client asked for "SPDY or if that is not supported then HTTP/1.1", your server will reply with "use HTTP/1.1". You'll see
TLS1.2 > http/1.1.