Nginx – why Chrome browser doesn’t recognize the nginx http2 server

google-chromehttp2nginx

I setup my Nginx conf as per Digital Ocean paper,
and now http2 is available…

But in Chrome (Version 54.0.2840.98 (64-bit)) Dev tool, it's always on HTTP 1/1 :

NAME             METHOD  STATUS  PROTOCOL
shell.js?v=xx..    GET    200     http/1.1

my server is running Ubuntu 16.04 LTS which supports both ALPN & NPN , and the openssl version shipped with it is 1.0.2g

I checked http2 support with this tool siteand the result is : 

Yeah! example.com supports HTTP/2.0. ALPN supported...

Also checking with curl is OK

 $ curl -I --http2 https://www.example.com
  HTTP/2 200 
  server: nginx/1.10.0 (Ubuntu)
  date: Tue, 13 Dec 2016 15:59:13 GMT
  content-type: text/html; charset=utf-8
  content-length: 5603
  x-powered-by: Express
  cache-control: public, max-age=0
  etag: W/"15e3-EUyjnNnyevoQO+tRlVVZxg"
  vary: Accept-Encoding
  strict-transport-security: max-age=63072000; includeSubdomains
  x-frame-options: DENY
  x-content-type-options: nosniff

I also checked with is-http2 cli from my console

is-http2 www.amazon.com
× HTTP/2 not supported by www.amazon.com
Supported protocols: http/1.1

is-http2 www.example.com
✓ HTTP/2  supported by www.example.com
Supported protocols: h2 http/1.1

tested with openssl from my localhost

$ echo | openssl s_client -alpn h2 -connect www.example.com:443 | grep ALPN
 depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
 verify return:1
 depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
 verify return:1
 depth=0 CN = example.com
 verify return:1
 ALPN protocol: h2
 DONE

why Chrome is left behind it ?
How can I check it also with Safari (v 10.0.1)

Best Answer

As per my answer on StackOverflow:

Will likely be one of two reasons:

  1. You are using anti-virus software and it is MITM your traffic and so downgrading you to HTTP/1.1. Turn off https traffic monitoring on your AV to connect directly to the server.

  2. You are using older TLS ciphers and specifically one that Chrome disallows for HTTP/2 (https://http2.github.io/http2-spec/#BadCipherSuites) as per Step 5 of above guide. Scan your site using https://www.ssllabs.com/ssltest/ to check your TLS config and improve it.

The third reason is lack of ALPN support in your SSL/TLS library (i.e. You are using openssl 1.0.1 and need to be one 1.0.2 or later, for example) but you have already confirmed you have ALPN support so skipping that for this answer.

Related Topic