The direct answer
Before admitting a fresh TLS connection to an HTTP/2-only operation, require supported evidence of its selected application protocol and bind that evidence to the exact connection and correct adapter. A trusted offer is not the server’s selection. Missing or mismatched evidence holds this profile; certificate validation, complete protocol support and current data permission remain independent prerequisites.
A secure service connection still needs the correct protocol adapter
A fictional AI artifact client has permission to contact one fixed service. Its proposed operation uses an HTTP/2 adapter. A dashboard reports that the TLS handshake succeeded, but the application still needs to know which application protocol belongs on that connection. Guessing from the service name would leave the adapter choice unexplained.
Select one fresh direct connection, with no proxy, pooling, reuse, redirects, upgrades, resumption or early data. The application owns an HTTP/2-only release plan. These are proposed boundaries, not inspected stack settings. No connection, offer, handshake, request, frame or runtime fixture was constructed; every card below is PROPOSED_UNRUN.
Keep the offer and selected protocol in different receipt fields
RFC 7301, Standards Track, July 2014, defines ALPN negotiation within TLS. The client advertises supported protocols; the server’s response contains one selection. Selection is from protocols supported by both sides; no common protocol requires a fatal no_application_protocol alert. The selected protocol governs the connection, and the extension’s result is connection-specific.
For our proposed application, the trusted offer and the expected operation protocol are separate records. A stack may support several protocols while this particular operation is admitted only through one. Record the complete approved offer, then compare the supported selection evidence with the application’s chosen branch.
A valid selection of another offered protocol can therefore fail this operation’s policy without proving that TLS negotiation was defective. Do not turn that mismatch into an automatic compatibility request. Changing the operation to another adapter would require a different reviewed plan.
The historical RFC is not a current TLS configuration recommendation. This worksheet adopts no claim about modern extension placement, protocol-name confidentiality, obsolete handshake flows or cryptographic safety. Actual supported TLS behavior and full validation remain independent requirements.
Use the HTTP/2 identifier without treating it as an implementation
RFC 9113, Standards Track, June 2022, says an HTTPS URI and its default port do not identify supported HTTP versions. HTTP/2 over TLS uses ALPN identifier h2, not h2c. After TLS negotiation, both endpoints send their respective HTTP/2 connection prefaces.
For this profile, matching h2 evidence is necessary but insufficient. The actual maintained adapter must implement the complete supported HTTP/2 lifecycle. A label cannot supply initialization, framing, settings, resource handling or complete response capture. This guide provides neither protocol bytes nor an alternative parser.
Keep the existing HTTP/1.1 receiver profile unchanged. It is not a fallback implementation for this connection. Likewise, selecting an application protocol cannot replace the existing service-identity review.
Bind evidence to the same connection before the adapter can act
Invent connection C-A, trusted offer revision O-A, operation plan P-A and HTTP/2 adapter A-A. These paper references identify the association that the application must establish. They are not handles, sockets or captured handshake results. The ordinary positive requires all four references to agree with complete independent evidence.
| Receipt field | Independent evidence required |
|---|---|
| Contact and service | Permitted destination, intended service and supported complete TLS validation. |
| Trusted plan and offer | P-A’s expected protocol and the full application-owned O-A offer. |
| Negotiation result | Supported completed-handshake disposition and actual selected protocol. |
| Connection association | The result belongs to this exact fresh C-A, not an earlier session or another attempt. |
| Adapter and ordering | A-A supports the protocol and cannot begin the affected path before its gate. |
| Operation release | Current object, recipient, purpose and data rights, with separate resource bounds. |
The gate must be feasible in the real adapter. If a stack automatically initializes a different protocol or releases data before exposing the required evidence, this paper profile is unavailable. A later log cannot establish that the earlier boundary was controlled.
Contact permission also precedes the handshake itself. Withholding a later application operation does not undo network traffic already sent. The receipt separates permitted contact, protocol eligibility and data release rather than compressing them into one success flag.
Walk eight inert connection-to-adapter cards
| Condition | Proposed disposition |
|---|---|
| 1. Complete matching C-A/O-A/P-A/A-A receipt and all prerequisites hold | Conditionally admit only the declared HTTP/2 operation plan. |
| 2. TLS identity passes but selected-protocol evidence is missing | Hold; the service name or port cannot fill this receipt cell. |
| 3. Another offered protocol is selected | Withhold this operation; do not silently change its adapter or policy. |
| 4. A selection is outside the offer, or negotiation reports no common protocol | Reject the unsupported negotiation disposition; no automatic fallback. |
| 5. The matching label belongs to another or reused connection | Reject its association with this fresh C-A. |
| 6. h2 matches but actual adapter support or ordering is unknown | Keep the operation ineligible; a name is not a working implementation. |
| 7. Cleartext, proxying, reuse, early data or another transport is substituted | Outside this deliberately fresh direct TLS profile. |
| 8. Negotiation fits but TLS, contact or current data authority fails | Deny that use independently. |
The positive concerns eligibility only. It claims no sent request, received artifact, successful peer implementation or completed business outcome. Preserve the separate error and unknown dispositions when reporting an actual attempt later.
Keep the unimplemented prerequisites visible
Actual stack and TLS security profile, complete offer and selection capture, observation timing, connection lifetime, adapter behavior, response completeness, resource limits and current rights are unknown here. Any missing requirement blocks a real positive. No library or installed server was inspected, and no fallback controller is supplied.
Boundary is prelaunch with planned request-path checks. This documentation worksheet is not a shipped ALPN verifier, HTTP/2 stack or transport enforcement service. No TLS, cryptographic, socket, HTTP, parser, API or model operation occurred. The existing synthetic policy evidence covers different behavior.
Primary sources
Official references supporting the guidance. Examples in this guide are synthetic and are not reports of a production incident.