一个连接被拒绝尝试通过 Nginx 1.25.3 + BoringSSL 利用 HTTP/3 时，Google Chrome v.120 中发生错误。没有错误，当 nginx-debug 开启时，日志中没有发现任何调试消息，http2 在该配置下运行良好，并且https://cloudflare-quic.com/表示浏览器可以使用 HTTP/3。
/etc/nginx/nginx.conf：
user www-data;
worker_processes 1;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
types_hash_max_size 2048;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
##
# Access/Error Log Settings
##
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log;
##
# SSL Configuration
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# FastCGI Cache Settings
##
fastcgi_cache_path /etc/nginx-cache levels=1:2 keys_zone=phpcache:100m inactive=60m;
fastcgi_cache_key "$scheme$request_method$host$request_uri";
fastcgi_ignore_headers Cache-Control Expires;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
/etc/nginx/sites-enabled/website.conf：
server {
server_name website.site;
root /var/www/website/public_html/develop;
index index.html;
listen 443 quic reuseport;
listen 443 ssl;
http2 on;
http3 on;
quic_retry on;
ssl_early_data on;
add_header alt-svc 'h3=":443"; quic=":443"; ma=2592000;';
ssl_protocols TLSv1.3;
ssl_certificate /etc/ssl/website.site.pem;
ssl_certificate_key /etc/ssl/website.site-key.pem;
}
更新：我注意到的另一个有趣的行为是连接被重定向到另一个可用的 nginx vhost（如果使用 quiche 服务，则监听会被忽略）
我的解决方案：问题在于，如果证书不受公众信任，Google Chrome 不会切换到 HTTP/3 协议（解决方案已找到这里)。然而，此处描述的可能原因有助于排除其他错误
答案1
您的 Web 浏览器首先建立 http/1 或 http/2 连接。因此您需要保留 2 个 listen 指令。您应该取消注释：
# listen 443 ssl http2;
并替换为：
listen 443 ssl;
http2 on;
因为 listen 指令不再接受 http2。这是一个默认禁用的新指令，请参阅https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2
Syntax: http2 on | off;
Default:
http2 off;
Context: http, server
This directive appeared in version 1.25.1.
和https://nginx.org/en/docs/http/ngx_http_core_module.html#listen
"The parameter is deprecated, the http2 directive should be used instead."
另请参阅此工作示例https://nginx.org/en/docs/quic.html#example
http {
log_format quic '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" "$http3"';
access_log logs/access.log quic;
server {
# for better compatibility it's recommended
# to use the same port for quic and https
listen 8443 quic reuseport;
listen 8443 ssl;
ssl_certificate certs/example.com.crt;
ssl_certificate_key certs/example.com.key;
location / {
# required for browsers to direct them to quic port
add_header Alt-Svc 'h3=":8443"; ma=86400';
}
}
}
答案2
我找到了一个示例配置，你还需要在 vhost 中添加一些内容
server{
listen 443 http3 quic reuseport;
listen 443 ssl http2;
quic_retry on;
ssl_early_data on;
http3_max_field_size 5000;
http3_max_table_capacity 50;
http3_max_blocked_streams 30;
http3_max_concurrent_pushes 30;
http3_push 10;
http3_push_preload on;
add_header alt-svc '$quic=":443"; ma=3600';
index index.html index.nginx-debian.html;
server_name yourdomain.com www.yourdomain.com
root /var/www/yourdomain.com;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
server{
if ($host = http3.codefaq.org) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name yourdomain.com;
return 404; # managed by Certbot
}