[英]Enable HTTP2 on nginx
I would like add HTTP2 support to my nginx server. 我想向我的nginx服务器添加HTTP2支持。 I think all version is good, with http_v2_module :
我认为所有版本都不错,使用http_v2_module :
nginx version: nginx/1.11.8
built by gcc 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.3)
built with OpenSSL 1.0.1f 6 Jan 2014
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed'
I've edit my vhost and add http2 ( listen 443 ssl http2; ), restart nginx, but no result. 我已经编辑了我的虚拟主机并添加了http2( 监听443 ssl http2; ),重新启动nginx,但是没有结果。
My vhost config : 我的虚拟主机配置:
server {
listen 80;
listen [::]:80 ipv6only=on;
server_name my-domaine.net;
return 301 https://my-domaine.net$request_uri;
}
server {
listen 80;
server_name www.my-domaine.net;
return 301 https://my-domaine.net$request_uri;
}
server {
listen 80;
server_name xx.xxx.xxx.xxx;
return 301 https://my-domaine.net$request_uri;
}
server {
listen 443 ssl http2;
server_name my-domaine.net;
access_log /var/log/nginx/app.dev.access.log;
error_log /var/log/nginx/app.dev.error.log;
ssl_certificate xxx;
ssl_certificate_key xxx;
ssl_session_timeout 1h;
ssl_session_cache shared:SSL:16m;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA
-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE
-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:!RC
4:!aNULL:!eNULL:!MD5:!EXPORT:!EXP:!LOW:!SEED:!CAMELLIA:!IDEA:!PSK:!SRP:!SSLv:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
ssl on;
# Eviter de se faire piller son site (merci dsfc.net)
add_header X-Robots-Tag "index,follow,noarchive";
# HSTS permet de déclarer au client directement dans la réponse HTTP qu'il faut communiquer en HTTPS
# Cette en-tête permet d'éviter le vol de cookies et le downgrade SSL
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
# Evite que le contenu soit interprété différemment que définit dans le mime Type
add_header X-Content-Type-Options nosniff;
# Protection contre le clickjacking
add_header X-Frame-Options "SAMEORIGIN";
# Protection contre les failles X-XSS
add_header X-XSS-Protection "1; mode=block";
# Faille spécifique à IE8
add_header X-Download-Options noopen;
# Interdire l'embarquement de tout ou partie de votre site dans un site ou logiciel tiers
add_header X-Permitted-Cross-Domain-Policies none;
location / {
#try_files $uri @prerender;
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header X-Forwarded-For $remote_addr;
}
location ~ ^/(images|fonts)/.*.(png|jpg|svg|jpeg|ttf|otf|woff|woff2|eot)$ {
root /opt/app/current/bundle/programs/web.browser/app;
access_log off;
expires max;
}
location ~ \.(css|html|ttf|otf|woff|woff2|eot)$ {
root /opt/app/current/bundle/programs/web.browser;
access_log off;
expires max;
}
}
If i test the http2 support on this site , i see http2 enabled. 如果我在此站点上测试了http2支持,则会看到已启用http2。 But on my browser networks, all request are http1 :/
但是在我的浏览器网络上,所有请求都是http1:/
Anyone have idea ? 有人知道吗?
Thank you ! 谢谢 !
You need to use Nginx compiled with openssl 1.0.2 or above for HTTP/2 to work on Chrome as it now requires the newer ALPN method of negotiating HTTP/2 and 1.0.1 only supports the older NPN method. 您需要使用由openssl 1.0.2或更高版本编译的Nginx,HTTP / 2才能在Chrome上运行,因为它现在需要协商HTTP / 2的更新的ALPN方法,而1.0.1仅支持旧的NPN方法。
See this page for more information: https://www.nginx.com/blog/supporting-http2-google-chrome-users/ 有关更多信息,请参见此页面: https : //www.nginx.com/blog/supporting-http2-google-chrome-users/
Once you fix that, there's another couple of gotchas that can catch you: why Chrome browser doesn't recognize my http2 server? 解决此问题后,还有另外两个陷阱可以吸引您: 为什么Chrome浏览器无法识别我的http2服务器?
You missed ip6, try to add it. 您错过了ip6,请尝试添加它。 Please make sure to enable http2 on both ip4 and ip6 (if your server supported ip6)
请确保同时在ip4和ip6上启用http2(如果服务器支持ip6)
listen [::]:80 http2 ipv6only=on;
听[::]:80 http2 ipv6only = on;
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.