How do I know if my Nginx config is actually using HTTP/2 or just claims to?

Question

I added http2 on; to my Nginx config on my Droplet a while back and assumed it was working. I recently read that HTTP/2 requires ALPN negotiation during the TLS handshake and that just adding the directive does not guarantee it is actually being used by clients. How do I verify from the outside whether my server is actually serving HTTP/2, and are there common misconfigurations that silently fall back to HTTP/1.1 without any error?

Bobby · Answer

Hi there, Good instinct to verify rather than assume. HTTP/2 requires TLS with ALPN negotiation, so if your setup is missing any piece of that chain, it silently falls back to HTTP/1.1 with zero errors, your site just works, quietly slower. Check from the outside with curl: curl -I --http2 -v https://yourdomain.com 2>&1 | grep -i "using http" You want to see Using HTTP2 in the output. If curl falls back and shows HTTP/1.1, something in the chain is broken. Check ALPN directly with openssl, which shows you what the server actually negotiated during the handshake rather than what curl decided to ask for: echo | openssl s_client -alpn h2 -connect yourdomain.com:443 2>&1 | grep -i "ALPN" You want to see ALPN protocol: h2 in the response. Common misconfigurations that cause a silent fallback: Your Nginx listen directive needs ssl and http2 together on modern Nginx (1.25+), the older syntax listen 443 ssl http2; was deprecated in favor of a separate http2 on; directive: listen 443 ssl; http2 on; If you have both an old-style directive and the new one, or a leftover listen 443 ssl http2; alongside a separate http2 on;, Nginx may not error but the config precedence can be inconsistent depending on version. Check with: nginx -V 2>&1 | grep -o "nginx/[0-9.]*" Also check that a reverse proxy or CDN in front of your Droplet (Cloudflare, a load balancer) is not itself terminating TLS and speaking HTTP/1.1 to your origin. HTTP/2 needs to be negotiated at whichever hop is doing the actual TLS termination the client sees, not necessarily your Nginx if something else sits in front. If you want to get more comfortable running diagnostic commands like this without risking your production server, this interactive Linux terminal simulator is a good place to practice curl and openssl syntax in a sandbox first.

alexdo · Answer

Heya, the ALPN explanation is right and the openssl s_client -alpn h2 check is the one I trust most too. Three things worth adding, two about the test itself and one specific to running on DigitalOcean. First, that curl test can give you a false negative. --http2 only works if your local curl was built with HTTP/2 support, and if it was not, curl cannot negotiate h2 no matter what the server offers. Check the client before trusting the result: curl -V | grep HTTP2 If HTTP2 is absent from the Features line, the test tells you nothing about your server. Second, grepping verbose output for “using http” is brittle, since that wording has moved around between curl versions. There is a dedicated output variable that just gives you the answer: curl -s --http2 -o /dev/null -w "http_version=%{http_version}
" https://yourdomain.com That prints http_version=2 on HTTP/2 and http_version=1.1 on a fallback. No parsing, no verbose flag, and it does not change shape between curl releases. Third, and this is the one most likely to explain a silent fallback on a Droplet specifically: if you have a DigitalOcean Load Balancer in front, your Nginx http2 on; has nothing to do with what clients negotiate. The Load Balancer terminates TLS, so the client speaks HTTP/2 only if the Load Balancer’s frontend protocol is set to HTTP/2, regardless of what Nginx is configured for. DigitalOcean’s Load Balancer documentation describes it explicitly as being able to “act as a gateway between HTTP/2 client traffic and HTTP/1.0 or HTTP/1.1 backend applications,” so HTTP/2 at the front and HTTP/1.1 to your Droplet is a supported and normal setup, not a bug. The practical consequence is that the frontend and backend protocols are set separately. A Load Balancer with an HTTPS frontend serves HTTP/1.1 to clients while your Nginx sits behind it with a perfectly correct http2 on; doing nothing for them. If your test from outside says 1.1 and your config looks right, check the Load Balancer’s frontend protocol setting before touching Nginx again. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

How do I know if my Nginx config is actually using HTTP/2 or just claims to?

Related questions

Why does my email look fine in Gmail but broken in Outlook, and how do I test this properly before sending?

Docker Networking Explained: How Containers Talk to Each Other

How to reset droplet firewall rules

How do I debug a broken deployment on a DigitalOcean Droplet when I have no idea what went wrong?

How to optimize Nginx reverse proxy caching for media streaming apps?

Any good resources to learn Linux commands in an interactive way?

Can I utilize ports 25 465 and 587? I want to setup postfix email server on ubuntu

problems when I try to run my project in the droplet

Problems with odoo and wkhtmltopdf in Kubernetes

How do you handle automated cost monitoring and alerts on DigitalOcean?

What’s a good learning path for deploying real projects on DigitalOcean?

What's the best way to get comfortable with the Linux command line as a beginner?

Report this

How do I know if my Nginx config is actually using HTTP/2 or just claims to?

Related questions

Why does my email look fine in Gmail but broken in Outlook, and how do I test this properly before sending?

Docker Networking Explained: How Containers Talk to Each Other

How to reset droplet firewall rules

How do I debug a broken deployment on a DigitalOcean Droplet when I have no idea what went wrong?

How to optimize Nginx reverse proxy caching for media streaming apps?

Any good resources to learn Linux commands in an interactive way?

Can I utilize ports 25 465 and 587? I want to setup postfix email server on ubuntu

problems when I try to run my project in the droplet

Problems with odoo and wkhtmltopdf in Kubernetes

How do you handle automated cost monitoring and alerts on DigitalOcean?

What’s a good learning path for deploying real projects on DigitalOcean?

What's the best way to get comfortable with the Linux command line as a beginner?