alpn + ciphers

Stefan Eissing <> Fri, 16 October 2015 11:31 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id B6E671A9091 for <>; Fri, 16 Oct 2015 04:31:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.912
X-Spam-Status: No, score=-6.912 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id rXmnR7oqP7Lp for <>; Fri, 16 Oct 2015 04:31:53 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 924B61A908D for <>; Fri, 16 Oct 2015 04:31:53 -0700 (PDT)
Received: from lists by with local (Exim 4.80) (envelope-from <>) id 1Zn3C1-0005sf-Hk for; Fri, 16 Oct 2015 11:29:01 +0000
Resent-Date: Fri, 16 Oct 2015 11:29:01 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <>) id 1Zn3Bx-0005ru-Ne for; Fri, 16 Oct 2015 11:28:57 +0000
Received: from ([]) by with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from <>) id 1Zn3Bv-0007g9-3g for; Fri, 16 Oct 2015 11:28:56 +0000
Received: from [] (unknown []) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Postfix) with ESMTPSA id 2D64515A047E for <>; Fri, 16 Oct 2015 13:28:29 +0200 (CEST)
From: Stefan Eissing <>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
Date: Fri, 16 Oct 2015 13:28:27 +0200
To: HTTP Working Group <>
Mime-Version: 1.0 (Mac OS X Mail 9.0 \(3094\))
X-Mailer: Apple Mail (2.3094)
Received-SPF: pass client-ip=;;
X-W3C-Hub-Spam-Status: No, score=-6.3
X-W3C-Hub-Spam-Report: AWL=-2.351, BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: 1Zn3Bv-0007g9-3g 7b550543d8d157db0eb52c5daff7fc48
Subject: alpn + ciphers
Archived-At: <>
X-Mailing-List: <> archive/latest/30366
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

A question regarding interworking and ALPN + ciphers:

During ALPN callbacks by popular SSL libs such as openssl, the cipher has/may not have been selected. This is a potential interworking problem when h2 is proposed, only to have the connection shutdown with INADEQUATE_SECURITY afterwards.

I am not certain if this is depending on the order TLS extensions appear in the client hello or the particular openssl implementation. Potentially, I could try to change the cipher list during the ALPN callback, but if that will influence things, is probably also not well defined. This you get, when you mix layers, I assume.

I am not sure what is the best way to address this. Limiting the cipher list to only highest grade is often not an option for a server. Any advice appreciated.