Re: Stricter TLS Usage in HTTP/2

On Jun 5, 2014, at 8:01 AM, Yoav Nir <ynir.ietf@gmail.com> wrote:

> We are abandoning NPN - an experimental extension used for nothing except negotiating SPDY, itself an experimental feature. Hopefully, but the time HTTP/2 is an RFC there will be a non-beta version of OpenSSL with ALPN. Regarding Java, I have no idea.

I’m on the Java EE EG, and I can tell you that Java EE8 plans to add APIs targeting HTTP/2 and that puts a priority on Java SE8 (the current release) to support everything needed. In the meantime, implementors will just add it themselves. It’s not that complicated IMO.

BTW I agree with the earlier comment that its a bad idea to go with NPN just because the libraries haven’t caught up. It might be slightly painful at first, but its far worse to have the spec tied to a non-ratified extension. 

Finally NPN is just as “inaccessible" as ALPN in Java ATM

--
Jason T. Greene
WildFly Lead / JBoss EAP Platform Architect
JBoss, a division of Red Hat

Received on Thursday, 5 June 2014 13:59:26 UTC