# What Is TLS-ALPN-01 Challenge (TLS-ALPN-01)? > TLS-ALPN-01 is an ACME challenge where the server proves domain control on port 443 by presenting a special certificate for the acme-tls/1 protocol. Source: https://ssl.sh/glossary/tls-alpn-01/ Last updated: 2026-11-10 TLS-ALPN-01, defined in [RFC 8737](https://www.rfc-editor.org/rfc/rfc8737), validates domain control inside a TLS handshake. The CA connects to port 443 with SNI set to the domain and offers only the [ALPN](https://ssl.sh/glossary/alpn/) protocol acme-tls/1. The server must answer with a self-signed certificate for that domain containing a critical acmeIdentifier extension whose value is the SHA-256 digest of the key authorization. No HTTP request is made at all. ## Why it matters TLS-ALPN-01 suits software that terminates TLS itself and cannot or should not serve port 80, such as Caddy, Traefik and other [reverse proxies](https://ssl.sh/glossary/reverse-proxy/). Because the challenge rides on a protocol name that browsers never request, it does not disturb normal traffic. It replaced the older TLS-SNI-01 method, which was withdrawn after it proved unsafe on shared hosting. Like [HTTP-01](https://ssl.sh/glossary/http-01/), it cannot validate wildcard certificates. ## Example ```bash # acme.sh standalone ALPN mode (port 443 must be free during validation) acme.sh --issue --alpn -d example.com # See what a server returns when asked for the challenge protocol openssl s_client -connect example.com:443 -servername example.com -alpn acme-tls/1