1. Introduction

1. Introduction

The Automatic Certificate Management Environment (ACME) [RFC8555] specification describes methods for validating control of domain names via HTTP and DNS. Deployment experience has shown it is also useful to be able to validate domain control using the TLS layer alone. In particular, this allows hosting providers, Content Distribution Networks (CDNs), and TLS-terminating load balancers to validate domain control without modifying the HTTP handling behavior of their backends.

This document specifies a new TLS-based challenge type, tls-alpn-01. This challenge requires negotiating a new application-layer protocol using the TLS Application-Layer Protocol Negotiation (ALPN) Extension [RFC7301]. Because this protocol does not build on a pre-existing deployment base, the ability to complete tls-alpn-01 challenges requires changes by service providers, making it explicitly an opt-in process. Because service providers must proactively deploy new code in order to implement tls-alpn-01, we can specify stronger controls in that code, resulting in a stronger validation method.