Hacker News new | past | comments | ask | show | jobs | submit login

HTTP/2 doesn't work without HTTPS.

The standard technically allows non-TLS HTTP/2, but most clients, and I'm guessing, servers, don't support non-TLS HTTP/2. nginx, for example, doesn't support non-TLS HTTP/2.




Nginx certainly supports unencrypted HTTP/2. I'm using it for my personal website to have Haproxy as a separate TLS terminator. Mainly so that my cert renewal scripts still work if there isn't an old cert available.


HTTP/2 is allowed to work over insecure connections as per the spec, but all browser vendors have decided that their browsers will not support unencrypted H/2 (no browser at all currently allows H/2 over HTTP). This means that in theory H/2 can run insecurely, but in practice it cannot.

https://http2.github.io/faq/#does-http2-require-encryption


I tried this a couple of days ago as I set up a new server, and when I enabled HTTP/2 on non TLS server blocks, my clients would just try to download a binary blob instead of showing the page I expected.

I fixed it after reading the following: http://serverfault.com/a/792857.

I admit I didn't look into it any further. Apologies if I spread wrong information.


That's a client issue, not an Nginx issue. Try accessing it through an stunnel tunnel, for example.

That said, AFAIK, the protocol negotiation works at the TLS level, so non-TLS servers need to listen on different ports for 1.1 and 2 if you want both.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: