<div><span class="font" style="font-family: times new roman, sans-serif;">OK. Thank you. But what about the HTTP/1.1 and HTTP/2 problem? As I mentioned before, I neogotiated with the server for H2 in the early ALPN. However the server only accepts HTTP/1.1 and why is that? My cURL has explicitly specified </span><span class="font" style="font-family: menlo, consolas, courier new, monospace, sans-serif;">--http2-prior-knowledge </span><span class="font" style="font-family: times new roman, sans-serif;"> but it still does not work</span><span class="font" style="font-family: times new roman, sans-serif;">. It still connects via HTTP/1.1.<br>Thank you for all your answers!</span></div><div><span class="font" style="font-family: times new roman, sans-serif;">Regards,</span><br></div><div><span class="font" style="font-family: times new roman, sans-serif;">David Hu</span><br></div><div><span class="font" style="font-family: times new roman, sans-serif;"><br></span></div><div class="protonmail_signature_block"><div class="protonmail_signature_block-user protonmail_signature_block-empty"><span class="font" style="font-family: times new roman, sans-serif;"><br></span></div><div class="protonmail_signature_block-proton"><span class="font" style="font-family: menlo, consolas, courier new, monospace, sans-serif;">[PGP Public Key attached, key ID: </span><span class="ellipsis"><span class="pre"><span class="font" style="font-family: menlo, consolas, courier new, monospace, sans-serif;">0x340A848D</span></span></span><span class="font" style="font-family: menlo, consolas, courier new, monospace, sans-serif;"> ; fingerprint: 340a 848d 4333 6873 d48f 5dad 8847 c44d 75c3 da38]</span></div></div><div><span class="font" style="font-family: times new roman, sans-serif;"><br></span></div><div class="protonmail_quote">
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐<br>
On Thursday, January 21st, 2021 at 10:08 PM, Thomas Ward <teward@thomas-ward.net> wrote:<br>
<blockquote class="protonmail_quote" type="cite">
<p>To clarify, I meant I don't run nginx.org's nginx server that
they have. ;)</p>
<p>The remaining IP tests by SSLLabs shows the same behavior -
<a href="https://www.ssllabs.com/ssltest/analyze.html?d=nginx.org&latest" target="_blank" rel="noreferrer nofollow noopener">https://www.ssllabs.com/ssltest/analyze.html?d=nginx.org&latest</a>
- so it's just a case of these servers being configured to only
use TLS 1.2. POSSIBLY they're using an older set of OpenSSL or
similar libraries that don't have TLS 1.3 yet, but it's also just
possible it's disabled - TLS 1.3 isn't exactly the most 'accepted'
protocol yet by certain policies and standards, so that's a
consideration too.</p>
<p><br>
</p>
<p>Thomas</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 1/22/21 1:04 AM, Thomas Ward wrote:<br>
</div>
<blockquote type="cite">
<p>So, I don't run the NGINX webserver, but I am pretty sure this
is on the remote server to serve the protocol right. SSLLabs
test shows that TLS 1.3 is just not offered.</p>
<p><a href="https://www.ssllabs.com/ssltest/analyze.html?d=nginx.org&s=3.125.197.172&latest" target="_blank" rel="noreferrer nofollow noopener">https://www.ssllabs.com/ssltest/analyze.html?d=nginx.org&s=3.125.197.172&latest</a></p>
<p>There's three other IPs (one IPv4 and two IPv6) that will very
likely reflect the same tests as well.</p>
<p>So to answer your original question:</p>
<p> > What have I done wrong or if it is your problem?</p>
<p>You didn't do anything wrong. TLS 1.2 is the only protocol
that's offered for SSL/TLS connections to the nginx.org site.</p>
<p><br>
</p>
<p>Thomas</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 1/21/21 11:50 PM, David Hu wrote:<br>
</div>
<blockquote type="cite">
<pre wrap="">So I have to downgrade to TLS v1.2. The full command input and the connection process can be shown as follows:
./curl -vvvvv --http2-prior-knowledge --tlsv1.2 <a href="https://nginx.org" target="_blank" rel="noreferrer nofollow noopener">https://nginx.org</a>
* Trying 52.58.199.22:443...
* Connected to nginx.org (52.58.199.22) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: D:\curl-7.74.0_2-win64-mingw\bin\curl-ca-bundle.crt
* CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: CN=nginx.org
* start date: Oct 29 16:45:05 2020 GMT
* expire date: Jan 27 16:45:05 2021 GMT
* subjectAltName: host "nginx.org" matched cert's "nginx.org"
* issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
* SSL certificate verify ok.
</pre>
<blockquote type="cite">
<pre wrap="">GET / HTTP/1.1
Host: nginx.org
User-Agent: curl/7.74.0
Accept: */*
</pre>
</blockquote>
<pre wrap="">* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.19.0
< Date: Fri, 22 Jan 2021 04:43:32 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 12676
< Last-Modified: Tue, 15 Dec 2020 14:58:52 GMT
< Connection: keep-alive
< Keep-Alive: timeout=15
< ETag: "5fd8cf2c-3184"
< Accept-Ranges: bytes
<
So I neogotiate with your server to force use HTTP/2 (i.e. H2) and ALPN is offering H2 and HTTP/1.1 but at the finally I only get the HTTP version HTTP/1.1 not H2. The same cURL specs and versions and specs as the above message. What have I done wrong or if it is your problem?
Thanks again.
Regards,</pre>
<br>
<fieldset></fieldset>
<pre wrap="">_______________________________________________
nginx mailing list
<a href="mailto:nginx@nginx.org" rel="noreferrer nofollow noopener">nginx@nginx.org</a>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" target="_blank" rel="noreferrer nofollow noopener">http://mailman.nginx.org/mailman/listinfo/nginx</a></pre>
</blockquote>
<br>
<fieldset></fieldset>
<pre wrap="">_______________________________________________
nginx mailing list
<a href="mailto:nginx@nginx.org" rel="noreferrer nofollow noopener">nginx@nginx.org</a>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" target="_blank" rel="noreferrer nofollow noopener">http://mailman.nginx.org/mailman/listinfo/nginx</a></pre>
</blockquote>
</blockquote><br>
</div>