--- a/mail_ssl.t
+++ b/mail_ssl.t
@@ -33,8 +33,11 @@ eval {
 };
 plan(skip_all => 'Net::SSLeay not installed') if $@;
 
+eval { exists &Net::SSLeay::P_alpn_selected or die; };
+plan(skip_all => 'Net::SSLeay with OpenSSL ALPN support required') if $@;
+
 my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap pop3 smtp/)
-	->has_daemon('openssl')->plan(20);
+	->has_daemon('openssl')->plan(22);
 
 $t->write_file_expand('nginx.conf', <<'EOF');
 
@@ -210,6 +213,17 @@ like(Net::SSLeay::dump_peer_certificate(
 ($s, $ssl) = get_ssl_socket(8148);
 like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=inherits/, 'CN inner');
 
+# alpn
+
+ok(get_ssl_socket(8148, undef, ['imap']), 'alpn');
+
+TODO: {
+local $TODO = 'not yet' unless $t->has_version('1.21.4');
+
+ok(!get_ssl_socket(8148, undef, ['unknown']), 'alpn rejected');
+
+}
+
 # starttls imap
 
 $s = Test::Nginx::IMAP->new(PeerAddr => '127.0.0.1:' . port(8149));
@@ -291,13 +305,14 @@ like(Net::SSLeay::dump_peer_certificate(
 ###############################################################################
 
 sub get_ssl_socket {
-	my ($port, $ses) = @_;
+	my ($port, $ses, $alpn) = @_;
 
 	my $s = IO::Socket::INET->new('127.0.0.1:' . port($port));
 	my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!");
 	Net::SSLeay::set_session($ssl, $ses) if defined $ses;
+	Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn;
 	Net::SSLeay::set_fd($ssl, fileno($s));
-	Net::SSLeay::connect($ssl) or die("ssl connect");
+	Net::SSLeay::connect($ssl) == 1 or return;
 	return ($s, $ssl);
 }