<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 26 Jun 2024, at 17:56, Roman Arutyunyan <<a href="mailto:arut@nginx.com" class="">arut@nginx.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<br id="lineBreakAtBeginningOfMessage" class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On 26 Jun 2024, at 7:21 PM, Riccardo Brunetti Host <<a href="mailto:riccardo.brunetti@host.it" class="">riccardo.brunetti@host.it</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Hello, thanks for the answer.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""><blockquote type="cite" class=""><div class="">On 26 Jun 2024, at 16:45, Roman Arutyunyan <<a href="mailto:arut@nginx.com" class="">arut@nginx.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<br id="lineBreakAtBeginningOfMessage" class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On 26 Jun 2024, at 6:15 PM, Riccardo Brunetti Host <<a href="mailto:riccardo.brunetti@host.it" class="">riccardo.brunetti@host.it</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello.<div class=""><br class=""></div><div class="">I have a Nginx server which acts as a reverse proxy for a given number of different domains and I’m trying to enable http3 for a subset of them.</div><div class=""><br class=""></div><div class="">I placed the directives:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div class=""> http3 on;</div><div class=""> listen xx.xx.xx.xx:443 default_server quic reuseport;</div><div class=""> quic_retry on;</div></blockquote><br class=""></div><div class="">in the default.conf file and then, only for those domains which I want http3 enabled I also add in the corresponding virtual host:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div class=""> http3 on;</div><div class=""> listen xx.xx.xx.xx:443 quic;</div><div class=""> quic_retry on;</div></blockquote><div class=""><br class=""></div>In the server section and <br class=""><br class=""></div><div class=""><blockquote type="cite" class=""><pre style="padding: 0px; margin-top: 0px; margin-bottom: 0px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">add_header Alt-Svc 'h3=":8443"; ma=86400';</pre></blockquote><div class=""><br class=""></div></div><div class="">Inside the location.</div><div class=""><br class=""></div><div class="">Now, what happens is that if I try to open the sites *with* http3 enabled, everything works as expected. If I try to open a site *without* http3 enabled, sometimes I have an SSL error because the server returns the “default virtual host” certificate.</div><div class="">It seems related to the type of browser.</div><div class=""><br class=""></div><div class="">Is it an expected behaviour or I am doing something wrong with the server configuration?</div></div></div></blockquote><div class=""><br class=""></div><div class="">If you use http/3 to access a virtual server that does not support http/3, the default http/3 server will be used.<br class=""></div><div class=""><br class=""></div><div class="">Make sure the above add_header does not affect the servers which do not support http/3.</div></div></div></div></blockquote><div class=""><br class=""></div><div class="">I add the header above only on the virtual hosts which I want to support http/3, thus it should not interfere with the other non http/3 domains.</div><div class="">Nevertheless, if I try with curl:</div><div class=""><br class=""></div><div class="">1) Site http/3 enabled:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""># curl --http3 -I -v https://<fqdn></blockquote><blockquote type="cite" class=""><div class="">* Host <fqdn>t:443 was resolved.</div><div class="">* IPv6: (none)</div><div class="">* IPv4: <ip></div><div class="">* WARNING: no socket in pollset, transfer may stall!</div><div class="">* Trying <ip>:443...</div><div class="">* Server certificate:</div><div class="">* subject: CN=<fqdn></div><div class="">* start date: May 14 07:39:37 2024 GMT</div><div class="">* expire date: Aug 12 07:39:36 2024 GMT</div><div class="">* subjectAltName: host “<fqdn>" matched cert's “<fqdn>"</div><div class="">* issuer: C=US; O=Let's Encrypt; CN=R3</div><div class="">* SSL certificate verify ok.</div><div class="">* Connected to <fqdn> (<ip>) port 443</div><div class="">* using HTTP/3</div><div class="">* [HTTP/3] [0] OPENED stream for https://<fqdn>/</div></blockquote>…</div><div class="">…</div><div class=""><br class=""></div><div class="">So it gets the correct certificate and it goes on using http/3</div><div class=""><br class=""></div><div class="">2) Site non http/3 enabled:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""># curl --http3 -I -v https://<fqdn></blockquote></div><div class=""><blockquote type="cite" class=""><div class="">* Host <fqdn>:443 was resolved.</div><div class="">* IPv6: (none)</div><div class="">* IPv4: <ip></div><div class="">* WARNING: no socket in pollset, transfer may stall!</div><div class="">* Trying <ip>:443...</div></blockquote><blockquote type="cite" class=""><div class="">* SSL certificate problem: unable to get local issuer certificate</div><div class="">* connect to <ip> port 443 failed: SSL peer certificate or SSH remote key was not OK</div></blockquote><blockquote type="cite" class=""><div class="">* Failed to connect to<fqdn> port 443 after 33 ms: SSL peer certificate or SSH remote key was not OK</div></blockquote><blockquote type="cite" class=""><div class="">* Trying <ip>:443...</div></blockquote><blockquote type="cite" class=""><div class="">* Connected to<fqdn> (<ip>) port 443</div></blockquote><blockquote type="cite" class=""><div class="">* ALPN: curl offers h2,http/1.1</div><div class="">* TLSv1.2 (OUT), TLS handshake, Client hello (1):</div><div class="">* TLSv1.2 (IN), TLS handshake, Server hello (2):</div><div class="">* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):</div><div class="">* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):</div><div class="">* TLSv1.3 (IN), TLS handshake, Certificate (11):</div><div class="">* TLSv1.3 (IN), TLS handshake, CERT verify (15):</div><div class="">* TLSv1.3 (IN), TLS handshake, Finished (20):</div><div class="">* TLSv1.3 (OUT), TLS handshake, Finished (20):</div><div class="">* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / [blank] / UNDEF</div><div class="">* ALPN: server accepted h2</div><div class="">* Server certificate:</div><div class="">* subject: CN=<fqdn></div></blockquote><blockquote type="cite" class=""><div class="">* start date: Apr 16 08:36:25 2024 GMT</div><div class="">* expire date: Jul 15 08:36:24 2024 GMT</div><div class="">* subjectAltName: host "<fqdn>" matched cert's "<fqdn>"</div></blockquote><blockquote type="cite" class=""><div class="">* issuer: C=US; O=Let's Encrypt; CN=R3</div><div class="">* SSL certificate verify ok.</div><div class="">* using HTTP/2</div><div class="">* [HTTP/2] [1] OPENED stream for https://<fqdn>/</div></blockquote></div><div class=""><br class=""></div><div class="">So it tries with http/3, gets a wrong certificate (the server default one), then it switches to http/2 and goes on. </div><div class="">The first attempt with http/3 probably gives problems with some browsers?</div><div class="">If this is the case, is there a way to avoid this or should I simply configure http/3 on all domains?</div></div></div></blockquote><div class=""><br class=""></div><div class="">Why would you (or client) connect to an http/3 port for a server which does not support http/3?</div><div class="">What would be your expectation in this case? The same will happen for http/1 and http/2 as well.</div><div class="">You can connect to an http/1 ssl port, request a missing server and receive a default server certificate.</div><div class="">It's just there is no fallback for http/1 and client will just give up.</div><div class=""><br class=""></div><div class="">The add_header suggests that http/3 is supported for a certain server.</div><div class="">It should not be sent for servers which do not support http/3, and clients should not use http/3 for them.</div></div></div></div></blockquote><div><br class=""></div><div>I agree with you, mine was an example just to show with curl what seems to happen with some browsers.</div><div>It seems to me that they try http/3 even if the server doesn’t advertise the header and then stop because of the error on the certificate.</div><div>I don’t know if this is something known.</div><div>Anyway, I think I will bypass this by enabling http/3 on all sites.</div><div><br class=""></div><div>Thanks a lot for you help</div><div><br class=""></div><div>Riccardo </div><br class=""><blockquote type="cite" class=""><div class=""><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""><blockquote type="cite" class=""><div class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" class=""><div class=""><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><div class="">If it does, this will mislead clients by offering them to switch to unsupported http/3.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Nginx version: nginx/1.26.1 on ubuntu 22.04</div><div class=""><br class=""></div><div class="">Thanks.</div><div class="">Riccardo</div></div>_______________________________________________<br class="">nginx mailing list<br class=""><a href="mailto:nginx@nginx.org" class="">nginx@nginx.org</a><br class=""><a href="https://mailman.nginx.org/mailman/listinfo/nginx" class="">https://mailman.nginx.org/mailman/listinfo/nginx</a><br class=""></div></blockquote></div><br class=""><div class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">----</div><div class="">Roman Arutyunyan</div><div class=""><a href="mailto:arut@nginx.com" class="">arut@nginx.com</a></div><div class=""><br class=""></div></div></div></div></div></blockquote><div class=""><br class=""></div><div class="">Riccardo</div><br class=""><blockquote type="cite" class=""><div class=""><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class="Apple-interchange-newline"><br class="Apple-interchange-newline"></div><br class=""></div>_______________________________________________<br class="">nginx mailing list<br class=""><a href="mailto:nginx@nginx.org" class="">nginx@nginx.org</a><br class=""><a href="https://mailman.nginx.org/mailman/listinfo/nginx" class="">https://mailman.nginx.org/mailman/listinfo/nginx</a><br class=""></div></blockquote></div><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">nginx mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="mailto:nginx@nginx.org" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">nginx@nginx.org</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="https://mailman.nginx.org/mailman/listinfo/nginx" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">https://mailman.nginx.org/mailman/listinfo/nginx</a></div></blockquote></div><br class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">----</div><div class="">Roman Arutyunyan</div><div class=""><a href="mailto:arut@nginx.com" class="">arut@nginx.com</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></div>_______________________________________________<br class="">nginx mailing list<br class=""><a href="mailto:nginx@nginx.org" class="">nginx@nginx.org</a><br class="">https://mailman.nginx.org/mailman/listinfo/nginx<br class=""></div></blockquote></div><br class=""></body></html>