ALPN Not supported

[koehn]

I cannot get HTTP2 support working off of httpd:2.4, despite enabling the mods and adding Protocol directives in my VirtualHosts. I think it's because the OpenSSL that's being used is too old. The debian:jessie-backports includes OpenSSL 1.0.2, which works with ALPN and thus HTTP2; any chance you'll be upgrading the packages?

Thanks!

[koehn]

Specifically, when I run curl -v --http2 [https url] I get the following relevant output (anipped for clarity):

* ALPN, offering h2
* ALPN, offering http/1.1
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
> GET / HTTP/1.1
> User-Agent: curl/7.51.0
> Accept: */*
> 

< HTTP/1.1 200 OK

When I run the same command against another server, I get ALPN and HTTP2.

[tianon]

@yosifkit didn't you look into this issue somewhat recently? Do you remember what your conclusion was?

If there's a simple fix, I'm all for it, but I worry that it might not be quite as simple as just bumping openssl.

In the meantime, the Alpine variants likely have a newer version of OpenSSL, and so would be worth testing against to see if they suffer from the same issue (httpd:2.4-alpine).

[yosifkit]

I don't quite remember but since we have the stretch sources for libnghttp2, we might as well get openssl from there too. I should have a test PR shortly.

@koehn, do you have a simple sample config we could use to test it?

Edit: 😞 I couldn't get httpd 2.4 to build against libssl-1.1 in stretch; went with libssl-1.0.0 in jessie-backports which gets us 1.0.2j

[koehn]

@yosifkit You can use a normal configuration, enable mod_http2, and set up a site using Protocols h2 http/1.1 (https://) or Protocols h2c http/1.1 (http://). For the latter you'll need to use curl --http2 for testing as no browsers support HTTP2 over HTTP.

You can use curl --http2 -v https://facebook.com for an example of what a successful negotiation looks like.

Of course, you'll need a curl that supports HTTP2.

[yosifkit]

Ok, I got it working with #43.