Hacker News Reader

Comment by tracker1 | Hacker News Reader

No mention of HTTPS, but don't all the current browsers, iirc require HTTPS for HTTP/2 support? Which would be the bigger boost, if they allocated certs (similar to letsencrypt) for the azure cdn. Or do they just require a cert setup for http2 support?

View on HN

HTTP/2 doesn't work without HTTPS.

The standard technically allows non-TLS HTTP/2, but most clients, and I'm guessing, servers, don't support non-TLS HTTP/2. nginx, for example, doesn't support non-TLS HTTP/2.

Nginx certainly supports unencrypted HTTP/2. I'm using it for my personal website to have Haproxy as a separate TLS terminator. Mainly so that my cert renewal scripts still work if there isn't an old cert available.

HTTP/2 is allowed to work over insecure connections as per the spec, but all browser vendors have decided that their browsers will not support unencrypted H/2 (no browser at all currently allows H/2 over HTTP). This means that in theory H/2 can run insecurely, but in practice it cannot.

https://http2.github.io/faq/#does-http2-require-encryption

I tried this a couple of days ago as I set up a new server, and when I enabled HTTP/2 on non TLS server blocks, my clients would just try to download a binary blob instead of showing the page I expected.

I fixed it after reading the following: http://serverfault.com/a/792857.

I admit I didn't look into it any further. Apologies if I spread wrong information.

That's a client issue, not an Nginx issue. Try accessing it through an stunnel tunnel, for example.

That said, AFAIK, the protocol negotiation works at the TLS level, so non-TLS servers need to listen on different ports for 1.1 and 2 if you want both.

Reply on news.ycombinator.com