delegated_credential
delegated_credential (RFC 9345) accepts short-lived server credentials. Only the Firefox profile of curl-impersonate sends it.
What it is
delegated_credential (extension 34) is defined in RFC 9345 for TLS 1.3. A server operator can use their certificate to sign a short-lived delegated credential, valid for at most 7 days by default, and give it to a frontend server. The frontend then authenticates with the credential instead of holding the certificate's private key.
This lets a CDN or a hosting provider terminate TLS for a customer without ever receiving the customer's long-term key. If a frontend is compromised, the stolen credential expires on its own within days. The client lists the signature schemes it accepts for credentials in the extension.
The certificate itself must carry a special DelegationUsage extension, so only certificates issued for this purpose can delegate.
Delegated credentials work only with TLS 1.3 and later; RFC 9345 does not allow them in earlier versions.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 1 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
In our data only the Firefox profile of curl-impersonate sends it, as its 9th extension. Chrome 153, curl_cffi, the Chrome profile of curl-impersonate and every plain library do not. Within our measurements it is therefore a marker of the Firefox profile.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for delegated_credential in the TLS details.
Run the TLS fingerprint test