How to enable HTTP/3, HTTP/2 on Nginx

aaP_demo1

Prerequisites:
• Nginx from 1.25.x to 1.27.x/latest version you can find.
Go to your site's config:

server {
    listen 80;
    listen 443 ssl http2;  # Enable HTTP/2 for fallback
    listen 443 quic reuseport;  # Enable HTTP/3 (QUIC)
    listen [::]:443 quic reuseport;  # Enable HTTP/3 for IPv6

    server_name domain.tld;
    index index.php index.html index.htm default.php default.htm default.html;
    root /www/wwwroot/domain.tld;

    http2 on;  # Enable HTTP/2
    http3 on;  # Enable HTTP/3

    ssl_certificate /path/to/your/certificate.crt;
    ssl_certificate_key /path/to/your/private.key;

    ssl_protocols TLSv1.2 TLSv1.3;  # Require TLS 1.2 or higher
    ssl_ciphers HIGH:!aNULL:!MD5;

    add_header Alt-Svc 'h3=":443"; ma=86400';  # Advertise HTTP/3 support

    # Other configurations...
}

Then, restart Nginx Service.
After, go to Security Feature → Firewall and Edit Port 443 → Change type (TCP) to (TCP/UDP)

Done.

aaPanel_doitauto

I am running Nginx 1.28 via aaPanel and would like to enable HTTP/3.
I already have --with-http_v3_module in the build, but --with-quic is missing, and my nginx.conf/vHost config file is much more complex than the short examples posted here.

My questions:
• Do the suggested settings (e.g. listen 443 ssl http2; listen 443 quic reuseport; ssl_protocols TLSv1.3; add_header Alt-Svc …) still apply in my case?
• Or could someone help me adjust my full config file so that HTTP/3/QUIC works correctly?

Thanks a lot!

server
{
listen 80;
listen 443 ssl;
listen 443 quic;
http2 on;
server_name xxx.de www.xxx.de;
index index.php index.html index.htm default.php default.htm default.html;
root /www/wwwroot/xxx.de/public;

#CERT-APPLY-CHECK--START
# Configuration related to file verification for SSL certificate application - Do not delete
include /www/server/panel/vhost/nginx/well-known/doitauto.de.conf;
#CERT-APPLY-CHECK--END
#SSL-START SSL related configuration, do NOT delete or modify the next line of commented-out 404 rules
#error_page 404/404.html;
#HTTP_TO_HTTPS_START
if ($server_port !~ 443){
    rewrite ^(/.*)$ https://$host$1 permanent;
}
#HTTP_TO_HTTPS_END
    ssl_certificate    /www/server/panel/vhost/cert/doitauto.de/fullchain.pem;
    ssl_certificate_key    /www/server/panel/vhost/cert/doitauto.de/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_tickets on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    add_header Alt-Svc 'h3=":443"; ma=86400' always;
    add_header Strict-Transport-Security "max-age=31536000" always;
    error_page 497  https://$host$request_uri;


#SSL-END

#ERROR-PAGE-START  Error page configuration, allowed to be commented, deleted or modified
error_page 404 /404.html;
error_page 502 /502.html;
#ERROR-PAGE-END

#PHP-INFO-START  PHP reference configuration, allowed to be commented, deleted or modified
include enable-php-83.conf;
#PHP-INFO-END

#REWRITE-START URL rewrite rule reference, any modification will invalidate the rewrite rules set by the panel
include /www/server/panel/vhost/rewrite/doitauto.de.conf;
#REWRITE-END

# Forbidden files or directories
location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md)
{
    return 404;
}

# Directory verification related settings for one-click application for SSL certificate
location ~ \.well-known{
    allow all;
}

#Prohibit putting sensitive files in certificate verification directory
if ( $uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$" ) {
    return 403;
}

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
    expires      30d;
    error_log /dev/null;
    access_log /dev/null;
}

location ~ .*\.(js|css)?$
{
    expires      12h;
    error_log /dev/null;
    access_log /dev/null; 
}
access_log /www/wwwlogs/dxxxo.de.log;
error_log  /www/wwwlogs/dxxxo.de.error.log;

}

aaP_demo1

aaPanel_doitauto
Hello, this is a late reply. Yes, you can configure according to my tutorial to achieve this.
Here is my nginx modules and info:

nginx version: nginx/1.28.0
built by gcc 11.5.0 20240719 (Red Hat 11.5.0-5) (GCC) 
built with OpenSSL 1.1.1q  5 Jul 2022
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=/www/server/nginx --add-module=/www/server/nginx/src/ngx_devel_kit --add-module=/www/server/nginx/src/lua_nginx_module --add-module=/www/server/nginx/src/ngx_cache_purge --add-module=/www/server/nginx/src/nginx-sticky-module-ng-1.3.0 --with-openssl=/www/server/nginx/src/openssl --with-pcre=pcre-8.43 --with-http_v2_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-http_stub_status_module --with-http_ssl_module --with-http_image_filter_module --with-http_gzip_static_module --with-http_gunzip_module --with-ipv6 --with-http_sub_module --with-http_flv_module --with-http_addition_module --with-http_realip_module --with-http_mp4_module --add-module=/www/server/nginx/src/ngx_http_substitutions_filter_module-master --with-ld-opt=-Wl,-E --with-cc-opt=-Wno-error --with-ld-opt=-ljemalloc --with-http_dav_module --add-module=/www/server/nginx/src/nginx-dav-ext-module --with-http_v3_module

aaP_amandaisaac2812

If you’re on aaPanel’s latest Nginx (1.25+), you can flip on both HTTP/2 and HTTP/3 per site. In the site’s config, add:

listen 443 ssl http2; # HTTP/2
listen 443 quic reuseport; # HTTP/3 (QUIC)
listen [::]:443 quic reuseport;

Make sure you’ve got a valid TLS cert (HTTP/3 needs TLS 1.3), then reload Nginx and test with curl -I --http3 https://yourdomain.com. That’s it—HTTP/2 stays as fallback, HTTP/3 kicks in for supported browsers.

aaPanel_doitauto

After applying these settings, my domain became unreachable after a few hours.
aaP_amandaisaac2812, I have now applied your settings and the HTTP/3 check shows OK (see screenshot). However, it also displays an error: HTTP/1.1 500 Internal Server Error. Would this be acceptable?

aaPanel_doitauto

I can only apply this setting to one domain. When I try to add the same configuration to my other domains, I get an error (see screenshot). However, without adding this setting, the other domains still pass the HTTP/3 test.

aaP_demo1

aaPanel_doitauto
For the other domain that wants to get the same http/3 configurations, you need to get rid of
reuseport. This will fix that error. Because that port 443 is occupied from your primary domain server block settings and you don't need to specify another resuseport parameter.

aaPanel_doitauto

I finally gave up on enabling HTTP/3 manually in aaPanel. At first, I managed to configure it so that the HTTP/3 check passed without issues, but after about an hour my domains started throwing errors, either in the backend or the frontend.

I believe the aaPanel developers should consider providing a built-in option for this. Ideally, aaPanel should offer a simple switch to enable HTTP/3 for domains, just like it already does with SSL or HTTP/2.

Right now, handling the listen directives for multiple domains causes conflicts and errors, which makes it very hard to maintain. A native function inside aaPanel would save a lot of time and make it stable.

I strongly think this is a feature aaPanel should add.

aaPanel_doitauto

I have tried everything, but it still doesn’t work :-(
• Removed HTTP/3 and QUIC from the vHost configs
• Adjusted the Alt-Svc header and even set it to ma=0
• Reloaded Nginx multiple times and checked the logs
• Tested Safari in private mode and cleared the cache
• Verified with curl under both HTTP/2 and HTTP/3

Still, Safari keeps showing errors, while Chrome and iPhone (mobile data) work without issues.

Can someone maybe take a look directly in my aaPanel? I can create an access for the person who is willing to help.