Ubuntu – How to get Apache, Ubuntu, and PHP7 to work with HTTP/2

apache-2.4http2Ubuntu

I have followed the steps mentioned at https://http2.pro/doc/Apache but my website still only serves files as HTTP/1.1. I can see that the mod_http2 is in the config with no errors on restarting Apache:

LoadModule http2_module /usr/lib/apache2/modules/mod_http2.so

And that the site has a fresh SSL cert from LetsEncrypt and the Protocol line in the site config Protocols h2 http/1.1, but Chrome still only shows that the files are served as HTTP/1.1.

Is there a step that is missing? Thank you.

Versions:
Apache 2.4.27,
Ubuntu 16.04.3,
PHP 7.0.22

Best Answer

I didn't see the Apache error log, and the message The mpm module (prefork.c) is not supported by mod_http2 was posting there. I followed the troubleshooting steps on the link I used above (https://http2.pro/doc/Apache) and switching to MPM Event and php-fpm fixed the issue.

Related Solutions

Ssl – How to build Apache httpd 2.4.20 on CentOS 7 with http2 support

I notice you are using this cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

However that cipher is black listed for HTTP/2: https://www.rfc-editor.org/rfc/rfc7540

And by default mod_http2 will not allow you to negotiate with blacklisted ciphers: https://httpd.apache.org/docs/2.4/mod/mod_http2.html#h2moderntlsonly

So I wonder if that is the only problem and you just need to enable more modern cipher suites? Specifically a ECDHE with GCM rather than CBC suite like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA25. You could always turn above flag off for your curl test but Chrome similarly uses this blacklist so you'll need to enable other ciphers anyway (and why wouldn't you want to since you've gone through the hassle of upgrading your openssl for this).

If that's not the issue then you could check out the step by step instructions I give here on how to build from source: https://www.tunetheweb.com/performance/http2/. I use Centos 7 and these steps work for me.

Getting HTTP/2 Working on Apache

Oh for goodness sake - why do I almost always figure stuff like this out AFTER I post the question. Oh well - hope this helps someone else.

The answer lies in the error log:

[Thu Aug 24 17:55:09.795729 2017] [http2:info] [pid 16949] AH03090: mod_http2 (v1.10.7, feats=CHPRIO+SHA256+INVHD+DWINS, nghttp2 1.24.0), initializing...
[Thu Aug 24 17:55:09.795846 2017] [http2:warn] [pid 16949] AH10034: The mpm module (prefork.c) is not supported by mod_http2. The mpm determines how things are processed in your server. HTTP/2 has more demands in this regard and the currently selected mpm will just not do. This is an advisory warning. Your server will continue to work, but the HTTP/2 protocol will be inactive.
[Thu Aug 24 17:55:09.827124 2017] [mpm_prefork:notice] [pid 16949] AH00163: Apache/2.4.27 (Debian) OpenSSL/1.0.2l configured -- resuming normal operations

So there we go - just use 'event' or 'worker' MPM instead of prefork.

Best Answer

Related Solutions

Ssl – How to build Apache httpd 2.4.20 on CentOS 7 with http2 support

Getting HTTP/2 Working on Apache

Related Topic