Featured image of post nginx 启用http3
linux

nginx 启用http3

从这个博客诞生的第一天起就是使用的http2，由于看到nginx 1.25.3 的官方发行镜像默认支持了http3，花了点时间把博客转成了http3和http2，虽然h3还不是很成熟，但是总要慢慢开始用才会成熟嘛。

前提条件：

  • 开启udp访问端口，我开了443的udp

配置如下：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

server {
    listen 443 quic reuseport;
    listen [::]:443 quic reuseport;
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    http3 on;
    http3_hq on;
    resolver 223.5.5.5;
    ssl_certificate /path/to/certificate/h2c.tech.crt;
    ssl_certificate_key /path/to/certificate/h2c.tech.key;
    ssl_protocols TLSv1.3;
    ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5;
    server_name h2c.tech;

    index index.html index.htm;
    error_page 400 = /400.html;
    server_tokens off;

    # Config for 0-RTT in TLSv1.3
    ssl_early_data on;
    ssl_stapling on;
    ssl_stapling_verify on;

    quic_retry on;
    quic_gso on;
    # Quic或HTTP/3响应头
    add_header Alt-Svc 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000';
    # HSTS
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

    location / {
        proxy_redirect off;
        proxy_pass http://127.0.0.1:1313;
        proxy_http_version 1.1;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        # 由于h3去掉了Host, 但是我后端没有Host会报错，所以自己设置下。
        proxy_set_header Host 'h2c.tech';

        # Config for 0-RTT in TLSv1.3
        proxy_set_header Early-Data $ssl_early_data;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name h2c.tech;
    return 301 https://h2c.tech/$request_uri;
}

成果：

http3