--- title: Leave SSL in the Dust, Turbocharge TLS with ALPN and SNI description: Teleport 8 introduces TLS routing that uses SNI and ALPN extensions to consolidate its many proxy ports down to a single port (443), reducing the network... canonical: https://daily.dev/posts/leave-ssl-in-the-dust-turbocharge-tls-with-alpn-and-sni-jgvmdzjwd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Leave SSL in the Dust, Turbocharge TLS with ALPN and SNI | daily.dev og:description: Teleport 8 introduces TLS routing that uses SNI and ALPN extensions to consolidate its many proxy ports down to a single port (443), reducing the network... og:url: https://daily.dev/posts/leave-ssl-in-the-dust-turbocharge-tls-with-alpn-and-sni-jgvmdzjwd og:image: https://api.daily.dev/og/posts/jgvMDZJwd.png og:image:alt: Leave SSL in the Dust, Turbocharge TLS with ALPN and SNI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Leave SSL in the Dust, Turbocharge TLS with ALPN and SNI **[Teleport](https://daily.dev/sources/teleport)** · 8 min read · 0 upvotes · 0 comments ## Summary Teleport 8 introduces TLS routing that uses SNI and ALPN extensions to consolidate its many proxy ports down to a single port (443), reducing the network attack surface. The post explains what SSL/TLS, SNI, and ALPN are, why Teleport historically needed many open ports (3022-3027, 3080, 3036), and how enabling multiplex proxy_listener_mode in the auth service config with a v2 Teleport configuration collapses these into one port. It also covers an edge case for database clients like psql that don't speak plain TLS, requiring tsh's local TLS-routing-aware proxy. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Teleport 8 reduce the number of open ports needed for its proxy? Teleport 8 introduces TLS routing that uses SNI to direct proxy or Kubernetes traffic and ALPN to determine which service to route to, consolidating ports 3023 through 3027 down to a single port, 443. This is enabled by setting proxy_listener_mode: multiplex under auth_service and using configuration version v2 to avoid legacy listeners. _daily.dev surfaces infrastructure changes like Teleport's port consolidation for teams hardening their network footprint._ ### What is the difference between Server Name Indication (SNI) and Application-Layer Protocol Negotiation (ALPN) in a TLS handshake? SNI lets a client specify the domain name it wants to reach during the initial TLS handshake, allowing a server to host multiple TLS certificates behind one IP address. ALPN lets the client send a list of supported application protocols in the Client Hello, so the server can negotiate which protocol, such as HTTP/2, to use without an extra round-trip. _Developers evaluating TLS extension tradeoffs can track deep dives like this on daily.dev._ ### How do database clients like psql work with Teleport's TLS routing since they don't support custom ALPN values? Because clients such as psql and mysql implement TLS handshakes as part of protocol-specific negotiation (STARTTLS) rather than speaking plain TLS with custom ALPN, Teleport's tsh client runs a local TLS-routing-aware proxy. The client connects to this local proxy, which establishes a proper TLS connection with the correct SNI and ALPN values to the Teleport proxy and tunnels the traffic through. _daily.dev helps engineers keep up with workarounds for database clients that lag behind protocol changes._ ## Similar posts on daily.dev - [The one Docker container that stopped me from exposing every service](https://daily.dev/posts/the-one-docker-container-that-stopped-me-from-exposing-every-service-i8van1j4d) · XDA Developers · 0 upvotes · 0 comments - [Self-hosted HTTP tunnels with SSH and nginx](https://daily.dev/posts/self-hosted-http-tunnels-with-ssh-and-nginx-qeu3pqxry) · Lobsters · 1 upvotes · 0 comments - [Stop opening firewall ports and start using identity](https://daily.dev/posts/stop-opening-firewall-ports-and-start-using-identity-xyrc1lkyd) · All Things Open · 0 upvotes · 0 comments - [Improving NAT traversal, pt. 3: looking ahead](https://daily.dev/posts/improving-nat-traversal-pt-3-looking-ahead-sd7jm9lvd) · Tailscale · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/leave-ssl-in-the-dust-turbocharge-tls-with-alpn-and-sni-jgvmdzjwd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Leave SSL in the Dust, Turbocharge TLS with ALPN and SNI","url":"https://daily.dev/posts/leave-ssl-in-the-dust-turbocharge-tls-with-alpn-and-sni-jgvmdzjwd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/leave-ssl-in-the-dust-turbocharge-tls-with-alpn-and-sni-jgvmdzjwd"},"datePublished":"2026-08-23T12:19:08.198Z","dateModified":"2026-08-23T12:30:59.368Z","description":"Teleport 8 introduces TLS routing that uses SNI and ALPN extensions to consolidate its many proxy ports down to a single port (443), reducing the network...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/leave-ssl-in-the-dust-turbocharge-tls-with-alpn-and-sni-jgvmdzjwd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ssh","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Leave SSL in the Dust, Turbocharge TLS with ALPN and SNI"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/leave-ssl-in-the-dust-turbocharge-tls-with-alpn-and-sni-jgvmdzjwd#faq","mainEntity":[{"@type":"Question","name":"How does Teleport 8 reduce the number of open ports needed for its proxy?","acceptedAnswer":{"@type":"Answer","text":"Teleport 8 introduces TLS routing that uses SNI to direct proxy or Kubernetes traffic and ALPN to determine which service to route to, consolidating ports 3023 through 3027 down to a single port, 443. This is enabled by setting proxy_listener_mode: multiplex under auth_service and using configuration version v2 to avoid legacy listeners. daily.dev surfaces infrastructure changes like Teleport's port consolidation for teams hardening their network footprint."}},{"@type":"Question","name":"What is the difference between Server Name Indication (SNI) and Application-Layer Protocol Negotiation (ALPN) in a TLS handshake?","acceptedAnswer":{"@type":"Answer","text":"SNI lets a client specify the domain name it wants to reach during the initial TLS handshake, allowing a server to host multiple TLS certificates behind one IP address. ALPN lets the client send a list of supported application protocols in the Client Hello, so the server can negotiate which protocol, such as HTTP/2, to use without an extra round-trip. Developers evaluating TLS extension tradeoffs can track deep dives like this on daily.dev."}},{"@type":"Question","name":"How do database clients like psql work with Teleport's TLS routing since they don't support custom ALPN values?","acceptedAnswer":{"@type":"Answer","text":"Because clients such as psql and mysql implement TLS handshakes as part of protocol-specific negotiation (STARTTLS) rather than speaking plain TLS with custom ALPN, Teleport's tsh client runs a local TLS-routing-aware proxy. The client connects to this local proxy, which establishes a proper TLS connection with the correct SNI and ALPN values to the Teleport proxy and tunnels the traffic through. daily.dev helps engineers keep up with workarounds for database clients that lag behind protocol changes."}}]} ```