attachment
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body dir="auto"><div dir="auto">I saw that in the wireshark traces - if Windows installs the printer as "ipps" or if the printer has both ipp and ipps enabled, the tls key exchange happens right after the tcp handshake. </div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div id="composer_signature" dir="auto"><div style="font-size:14px;color:#909090" dir="auto">Sent from my Verizon, Samsung Galaxy smartphone</div></div><div dir="auto"><br></div><div><br></div><div align="left" dir="auto" style="font-size:100%;color:#000000"><div>-------- Original message --------</div><div>From: Michael Sweet <msweet@msweet.org> </div><div>Date: 7/3/25 11:12 AM (GMT-05:00) </div><div>To: John Madden <jpmsparks@yahoo.com> </div><div>Cc: PWG IPP Workgroup <ipp@pwg.org> </div><div>Subject: Re: IPPS connection on Windows </div><div><br></div></div>John,<br><br>IPP doesn't use STARTTLS - that's a SMTP thing. "ipp:" and "ipps:" URIs map to "http:" and "https:" URIs, per RFCs 3510 ("ipp" URI scheme), 7472 ("ipps" URI scheme), and 8010 (IPP/1.1: Encoding and Transport),<br><br>Connections for "ipp:" URIs start out unencrypted. If the Client wants to force TLS encryption, it can send an OPTIONS request with an "Upgrade: TLS" header. If a Printer (server) wants to force TLS encryption, it can respond with status 426 (Upgrade Required) with an "Upgrade: TLS" header. The TLS negotiation follows, much like STARTTLS for SMTP. See RFC 2817 for more details.<br><br>Connections for "ipps:" URIs start with a TLS negotiation, just like "https:" URIs. This was originally documented in RFC 2818 and is now part of RFC 9110.<br><br><br>> On Jul 2, 2025, at 7:49 PM, John Madden <jpmsparks@yahoo.com> wrote:<br>> <br>> Michael,<br>> <br>> Smith Kennedy asked me to check with you as you are the subject matter expert on IPPS connection on port 631 and how they are established. Based<br>> <br>> on his feedback and tests I ran at work, I have altered an explanation I had in the book. When checked in WireShark, my former paragraph<br>> <br>> I had assuming STARTTLS on ipps on port 631 proved - as Smith Kennedy said - to be incorrect. I have included a Word doc with my new observations and<br>> <br>> I was hoping you could check this over for clarity. The ClientHello, ServerHello, ClientKeyExchange, and final printer messages can clearly be seen on the<br>> <br>> traces of a printer installed in windows with a URL of ipps://<printer name>/ipp/print.<br>> <br>> <br>> Thanks<br>> <Information on IPPS connection establishment.docx><TLS_Can_Begin.png><br><br>________________________<br>Michael Sweet<br><br></body></html>