Re: Stricter TLS Usage in HTTP/2

On Jun 4, 2014 9:47 AM, "Cory Benfield" <cory@lukasa.co.uk> wrote:
> Happy to mandate at least one of NPN and ALPN for both servers and
> clients. Servers _should_ support both but I see no reason to turn
> that into a must.

You have to have one of:
- support ALPN
- support NPN
- support both on client, either on server
- support either on client, both on server

Or you get the problem where peers support different mechanisms and
negotiation fails.

We have chosen the first option. The document didn't say MUST, but it is
still normative this regard.

We do recognize that - for a short while at least - NPN is more accessible
to some. So many people have enabled NPN to facilitate testing of other
parts of the protocol.