supported_versions
The extension that lists the TLS versions a client supports. It is how TLS 1.3 is negotiated, and every measured client sends it.
What it is
supported_versions (extension 43) was introduced by RFC 8446. The client lists the TLS versions it accepts, usually TLS 1.3 and TLS 1.2, in order of preference. A TLS 1.3 server picks one from that list and confirms it in the same extension of its reply.
The extension exists because the old version field in the ClientHello could not be used. Many middleboxes and servers broke when that field held a version they did not know, so TLS 1.3 keeps it frozen at TLS 1.2 (0x0303) and negotiates the real version here instead.
Browsers also put a GREASE value into this list, so servers keep tolerating version numbers they do not recognize. A client that sends this extension but lists only TLS 1.2 is rare; in practice its presence means the client is ready for TLS 1.3, and its absence points to an old TLS library.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 12 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
All measured clients send it, since all of them support TLS 1.3. Its position differs: 1st for macOS curl, 2nd for curl_cffi, and 9th to 12th for the OpenSSL- and Go-based libraries.
JA4 reads the TLS version for its prefix from this extension, which is why a TLS 1.3 client shows t13 there.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for supported_versions in the TLS details.
Run the TLS fingerprint test