This is usually used by TLS terminators, which don't have an HTTP server available (can understand TLS but not HTTP). ALPN here is a property of TLS ClientHello

This is usually used by TLS terminators, which don't have an HTTP server available (can understand TLS but not HTTP). ALPN here is a property of TLS ClientHello which specifies the capabilities of the client, usually used to signal support for HTTP 2 but in this specific case signals that the TLS client is an ACME verier on behalf of a CA, so the TLS server only sends the validator certificate when the validators specifically requesting it (ensuring interruption-free validation). The important part here is that a TLS server is available but HTTPS is not available as it is either only a TLS terminator or something that operates a non-HTTPS TLS server (for example, RTMPS).