SSL http2 not enabled - possible bug

Hello,

I want to enable http2.

The tests by HTTP/2 Test - Verify HTTP/2 Support | KeyCDN Tools
shows
HTTP/2 protocol is supported.
ALPN extension is supported.

but then I will enable Developer Tools in Chrome there is info that protocol http1.1 is used.


I have two VPS, 1st with custom nginx template and 2nd one.
The second VPS: I was using option 22, so everything was configured automatically. There is no http2 too.

1st VPS: I nginx config

Code (Text):

server {
  listen 443 ssl http2;

VPS 2 with 22 option and Wordpress

Code (Text):

server {
  listen 443 ssl http2 reuseport;

Why the http2 is not enabled?
How to enable it?



Current Nginx Version: 1.17.8
PHP 7.3.14



More interesting things is when I am checking

Code (Text):

nghttp -nv https://www.domain.com:443

There is info: The negotiated protocol: h2

but Developers tools show something different.

The same situation is on this forum

Code:

https://community.centminmod.com

Please have a look HTTP/1.1 not H2:





@eva2000 is is a bug?

Please have a look that other resources are h2.
H2 like https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Only HTTP/1.1 not H2.

---

PS.
My 3rd VPS where is copy of webiste is OK
But there are old php
PHP 7.2.28
nginx version: nginx/1.17.9

and on the 3rd VPS I can see H2 on the Developer Tools.

 

I am using Free Plan for VPS2 for blogs.

But for VPS 2 and 3 I do not use Cloud Flare.
There are copy of webiste and on VPS3 there is H2 (php 7.2)
but on VPS1 there is NO h2.


VPS1 CoudFlare Wordpress no H2
VPS2 NO CouldFlare, no H2
VPS3 NO CouldFlare, H2 but thre is php 7.2


Why 1 time Chrome Webmaster Tool show h2?
I will double check.

 

Interesting I have no http2 for your link.

Code (Text):

curl -4Iv https://community.centminmod.com
* About to connect() to community.centminmod.com port 443 (#0)
*   Trying 104.22.34.139...
* Connected to community.centminmod.com (104.22.34.139) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=centminmod.com,O="Cloudflare, Inc.",L=San Francisco,ST=CA,C=US
*       start date: Mar 10 00:00:00 2020 GMT
*       expire date: Oct 09 12:00:00 2020 GMT
*       common name: centminmod.com
*       issuer: CN=CloudFlare Inc ECC CA-2,O="CloudFlare, Inc.",L=San Francisco,ST=CA,C=US
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: community.centminmod.com
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Thu, 26 Mar 2020 23:45:44 GMT
Date: Thu, 26 Mar 2020 23:45:44 GMT
< Content-Type: text/html; charset=UTF-8
Content-Type: text/html; charset=UTF-8
< Connection: keep-alive
Connection: keep-alive
< Set-Cookie: __cfduid=d540754311ed7be1f6a0de910ee61ee461585266344; expires=Sat, 25-Apr-20 23:45:44 GMT; path=/; domain=.centminmod.com; HttpOnly; SameSite=Lax
Set-Cookie: __cfduid=d540754311ed7be1f6a0de910ee61ee461585266344; expires=Sat, 25-Apr-20 23:45:44 GMT; path=/; domain=.centminmod.com; HttpOnly; SameSite=Lax
< CF-Ray: 57a4bf3f1a5bc2b8-FRA
CF-Ray: 57a4bf3f1a5bc2b8-FRA
< Age: 629
Age: 629
< Cache-Control: public, max-age=1200
Cache-Control: public, max-age=1200
< Expires: Fri, 27 Mar 2020 00:05:44 GMT
Expires: Fri, 27 Mar 2020 00:05:44 GMT
< Strict-Transport-Security: max-age=31536000; includeSubdomains
Strict-Transport-Security: max-age=31536000; includeSubdomains
< Vary: Accept-Encoding
Vary: Accept-Encoding
< CF-Cache-Status: HIT
CF-Cache-Status: HIT
< CF-CacheTime: 1200
CF-CacheTime: 1200
< CF-Default-Rule: 1
CF-Default-Rule: 1
< CF-Req-Country: DE
CF-Req-Country: DE
< CF-TLS: TLSv1.2
CF-TLS: TLSv1.2
< Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
< Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
< Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: strict-origin-when-cross-origin
< X-Content-Type-Options: nosniff
X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
X-Frame-Options: SAMEORIGIN
< X-Powered-By: centminmod
X-Powered-By: centminmod
< X-Xss-Protection: 1
X-Xss-Protection: 1
< Server: cloudflare
Server: cloudflare
< alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400

<
* Connection #0 to host community.centminmod.com left intact

Code (Text):

PING community.centminmod.com 104.22.35.139

my domain respond below:

Code (Text):

 Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=domain.com
*       start date: Jan 14 19:05:16 2020 GMT
*       expire date: Apr 13 19:05:16 2020 GMT
*       common name: domain.com
*       issuer: CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US
> HEAD / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.domain.com
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
[/CODE]

 

I have used the same browser now.
I have the same situation like for the forum.

All resources from my domain are http1.1 only 3rd party are h2.

Why it happen?

 

I think i was false positive with VPS3, but on both PC i have the same browser
Version 80.0.3987.149 (Official Build) (64-bit)


When I use hosts to connect directly to the second server I have http1.1 too.
But when I use my USA VPS with windows to connect to US page there is H2.
Weird.

 

VPS3 whern from one VPS with windows I can see h2, but with my PC when I use IP and hosts file to connect to USA VPS I see http1.1.

VPS3:

Code (Text):

nginx -V
nginx version: nginx/1.17.9 (060320-023247-centos7-kvm-9e5afa5)
built by gcc 8.3.1 20190311 (Red Hat 8.3.1-3) (GCC)
built with OpenSSL 1.1.1d  10 Sep 2019
TLS SNI support enabled
configure arguments: --with-ld-opt='-Wl,-E -L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib -flto=2 -fuse-ld=gold' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto=2 -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wno-cast-function-type -Wno-format-extra-args -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --build=060320-023247-centos7-kvm-9e5afa5 --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.5 --add-dynamic-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.32 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.15 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.1d --with-openssl-opt='enable-ec_nistp_64_gcc_128 enable-tls1_3 -fuse-ld=gold'

 

George I have check community.centminmod.com on my VPS with windows and there it show h2 for community.centminmod.com.

It is very weird my maybe my Bitdefender block it.


But why it do not block other connections and 3rd party connections are as H2?

 

Ok I have found the problem. Bidefender block most of SSL.
Possible non Letsencrypt SSL was OK.



I have turned off this and now all links are as H2.

It is very weird problem. Possible slow down webistes for Bitdefender users.

 

I have double check everything and it is OK. On every VPS is H2.
I am sorry for false positive alert.
This Bitdefender is ..... I will not end.

 

Last thing George how to check if brotli is enabled?

and

How to use
curl -4Iv with my Centos?

How to update it?



Thank you for your help. I thought that is a bug, but the bug is in Bitdefender.