Why is nginx serving http2, or is it?

Question

Been trying to get http2 going on my nginx server, and I'm confused about some things. I've looked around here and around the web, but I did not find exactly what I'm looking for, or it's answered using outdated information from back when it was still not "released".

I have working nginx server, using vhosts. It has the http_v2 module

me@server:/etc/nginx$ sudo nginx -V | grep http2
nginx version: nginx/1.10.3
built with OpenSSL 1.1.0f  25 May 2017
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-2tpxfc/nginx-1.10.3=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_xslt_module=dynamic --with-stream=dynamic --with-stream_ssl_module --with-mail=dynamic --with-mail_ssl_module --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/nginx-auth-pam --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/nginx-dav-ext-module --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/nginx-echo --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/nginx-upstream-fair --add-dynamic-module=/build/nginx-2tpxfc/nginx-1.10.3/debian/modules/ngx_http_substitutions_filter_module

(not sure how to highlight the "--with-http_v2_module" in a codeblock)

One of my vhosts has a working ssl (using letsencrypt).

server {
    listen       80;
    server_name  example.com;
    return       301 http://www.example.com$request_uri;
}

server {
    server_name www.example.com;
    access_log /log/example.com/access.log;
    error_log /log/example.com/error.log;
    root /www/www.example.com/public;

    client_max_body_size 100M;

    index  index.php;

    location / {
        # my location config there ...
    }

    listen 80; # managed by Certbot
    listen 443 ssl; # managed by Certbot

    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    ssl_session_cache shared:le_nginx_SSL:1m; # managed by Certbot
    ssl_session_timeout 1440m; # managed by Certbot

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # managed by Certbot
    ssl_prefer_server_ciphers on; # managed by Certbot

    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA"; # managed by Certbot

   ssl_dhparam /etc/ssl/certs/dhparam.pem;
}

I would like http2 enabled for it.

Every doc I've seen says I only need to add "http2" after "ssl": listen 443 ssl;, and if I do that nginx happily restart with no error.

I wanted to try if it was working, and couldn't find the protocol in chrome network console anymore. So I found https://tools.keycdn.com/http2-test, which said it worked.

So my questions:

1 - How can I see in chrome (if possible, another if not) if a connection is done over http2 ?

2 - Do I still only need to add the "http2" directive to enable it in my vhost after ssl ? So I do not need to add it to my non-ssl / listen on port 80 line, as that case will be automatically handled between the browser and server during the request, right ?

I don't have any errors or anything, I just wonder how to check that it uses http2 when it can and things work as they should ...

Thanks.

Rob · Answer 1 · 2017-08-26T17:35:13.967

2

You have a few things not quite right. A server block can't be listening on port 80 and 443 at the same time. Nowhere do you have anything that tells the server to use http/2 either. You are also redirecting port 80 to port 80 in the first block.

Here's the start of mine:

server {
    listen 80;
    server_name mine.com www.mine.com;
    root /var/empty;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name  mine.com www.mine.com;
    root /home/mine;
    index index.html;
    charset utf-8;

Notice that the first block redirects to https and the second only listens on port 443 as http2.

Note: Your comments gives credit to certbot for a lot of things but certbot doesn't manage anything. It's only a script that gets you certs from LetsEncrypt and that's all. It doesn't "manage" anything beyond that.

EDIT: How can you tell it's working? You should have a green lock in the address bar on the left side. I've been using Firefox mostly because I had a problem with my Chrome install and I noticed I couldn't find the full information in the Chrome dev tools about the protocol. In Firefox it's under networking and listed clearly as 'http2'.

edited Aug 26 '17 at 17:35

answered Aug 26 '17 at 17:23

Rob

335
3
15

Certbot using the nginx plugin edits your nginx config files automatically (add the challenge, remove it, add the ssl lines afterwards). That's where those lines come from. – user933740 Aug 26 '17 at 17:34
@user933740 Unless your OS does something completely different from mine, or certbot just works differently, certbot does not edit nginx config files. – Rob Aug 26 '17 at 17:36
https://certbot.eff.org/docs/using.html#nginx (used with `certbot --nginx`) Is a plugin specifically made for that. It's pretty much `certbot --webroot` + editing the config files automatically. – user933740 Aug 26 '17 at 17:38
Oh and you can get nginx to listen on multiple port, using one port per directive: https://serverfault.com/questions/655067/is-it-possible-to-make-nginx-listen-to-different-ports . My first server block is not to handle port 80 but to redirect example.com to its www subdomain. – user933740 Aug 26 '17 at 17:40
1

One can have a single virtual host listen to both ports 80 and 443, there isn't nothing that prevents it in principle. However, the preferred way is to have http -> https redirect, and then you need separate virtual hosts for optimal operation. – Tero Kilkanen Aug 26 '17 at 17:40
Yes, you can listen on multiple ports but you are wanting to redirect 80 to 443 so you can't listen on 80 and redirect to 80 again but I see, now, that you had two server names. – Rob Aug 26 '17 at 17:44
About certbot: I had forgotten that it now comes with the auto configure thing but it shows how long we've been using LetsEncrypt and certbot. I won't use that since our server set up can be intense so we manually enter what's needed. – Rob Aug 26 '17 at 17:58

score 0 · Answer 2 · answered Aug 28 '17 at 13:46

1 - How can I see in chrome (if possible, another if not) if a connection is done over http2 ?

In chrome, you can do it in the developer tools, in the "network" tab. However, by default, the protocol is not showed: you need to right click on one of the column name and select "protocol".

2 - Do I still only need to add the "http2" directive to enable it in my vhost after ssl ? So I do not need to add it to my non-ssl / listen on port 80 line, as that case will be automatically handled between the browser and server during the request, right ?

You are right, you only have to add the "http2" directive after the ssl line, as a non-secure request is redirected to a secure one using HTTP/2.

"as a non-secure request is redirected to a secure one using HTTP/2.": Could you cite a source for this? — gxx, Aug 28 '17 at 14:57
From the nginx directives present in the author's question. (Here I call a secure request a request redirected to use SSL). — eli0T, Aug 28 '17 at 21:03

Why is nginx serving http2, or is it?

2 Answers2