Implementing HTTP/3 with NGINX

As HTTP/3 gains traction, many system administrators are looking to implement this protocol to improve their web server performance. This guide will walk you through the process of setting up HTTP/3 with NGINX, focusing on a multi-domain setup using the sites-available configuration style.

What is HTTP/3?

HTTP/3 is the latest version of the Hypertext Transfer Protocol, built on top of QUIC (Quick UDP Internet Connections). Unlike its predecessors, which rely on TCP (Transmission Control Protocol), HTTP/3 uses UDP (User Datagram Protocol) to provide faster connection setups and improved handling of packet loss. Key benefits include:

• Faster Connection Establishment: HTTP/3 reduces the number of round trips required to establish a secure connection.
• Multiplexing: Multiple streams can be sent over a single connection without head-of-line blocking.
• Enhanced Security: Built-in encryption ensures secure data transmission.

Prerequisites

• NGINX version 1.26.0 or later (avoid 1.25.x due to known HTTP/3 issues)
• OpenSSL 1.1.1 or later
• Root access to your server
• SSL certificates for your domains

Step 1: Update NGINX Configuration

Edit /etc/nginx/nginx.conf:

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    # Global HTTP/3 settings
    http3_stream_buffer_size 1m;
    quic_retry on;
    ssl_early_data on;
    quic_gso on;

    # Generate this key using: openssl rand -base64 32
    quic_host_key /etc/nginx/ssl/quic_host.key;

    ssl_protocols TLSv1.3;

    # Other standard settings...

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

Step 2: Generate QUIC Host Key

openssl rand -base64 32 > /etc/nginx/ssl/quic_host.key
chmod 400 /etc/nginx/ssl/quic_host.key
chown www-data:www-data /etc/nginx/ssl/quic_host.key

Step 3: Configure Individual Domains

Create /etc/nginx/sites-available/domain1.conf:

server {
    listen 443 ssl;
    listen 443 quic reuseport;
    listen [::]:443 ssl;
    listen [::]:443 quic reuseport;
    server_name domain1.com;

    ssl_certificate /etc/letsencrypt/live/domain1.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain1.com/privkey.pem;

    http2 on;
    http3 on;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;

    root /var/www/domain1.com;
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php?$args;
        add_header Alt-Svc 'h3=":443"; ma=86400' always;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        add_header Alt-Svc 'h3=":443"; ma=86400' always;
        add_header X-FastCGI-Cache $upstream_cache_status always;
    }
}

Repeat for other domains, removing reuseport from subsequent configurations.

Step 4: Firewall Configuration

When implementing HTTP/3, it’s crucial to ensure that your firewall allows traffic on UDP port 443, in addition to the standard TCP port 443. This is because HTTP/3 uses QUIC, which operates over UDP.

Step 5: Testing and Verification

Perform these tests from a remote server to ensure your configuration is working correctly:

1. Check UDP port accessibility: For IPv4:

   nc -vuzw 3 domain1.com 443

For IPv6:

   nc -6 -vuzw 3 domain1.com 443

You should see: “Connection to domain1.com (xxx.xxx.xxx.xxx) 443 port [udp/https] succeeded!”

2. Test HTTP/3 with curl (via Docker):

   docker run -it --rm ymuski/curl-http3 curl -ILv https://domain1.com/ --http3

Look for “Using HTTP/3” in the output.

Common Issues and Troubleshooting

1. Connection reverts to HTTP/2:

• Ensure NGINX 1.26.0 or later is used.
• Check that UDP port 443 is open and accessible.

1. Headers not being set:

• Remember that add_header directives override inherited headers.
• Include all necessary headers in each relevant location block.

1. IPv6 not working:

• Verify IPv6 is enabled on your server and properly configured in NGINX.

1. UDP port not accessible:

• Check firewall rules on both host and container (if applicable).
• Verify NAT configuration for LXC setups.

Performance Monitoring

After implementation, monitor your site’s performance:

1. Use tools like WebPageTest or Chrome DevTools to compare HTTP/2 and HTTP/3 performance.
2. Monitor server resources, as HTTP/3 may increase CPU usage.
3. Keep an eye on error logs for any HTTP/3-related issues.

Conclusion

Implementing HTTP/3 with NGINX can significantly improve your website’s performance, especially for users on unreliable networks. However, it requires careful configuration and ongoing monitoring. Stay updated with the latest NGINX releases and HTTP/3 developments to ensure optimal performance and security.

Remember, HTTP/3 is still evolving, and implementations are being refined. Regular testing and staying informed about updates are key to a successful deployment.