在apache 2中启用HTTP/2

我的apache配置有问题。服务器不与HTTP/2回应：在apache 2中启用HTTP/2

$ curl -v --http2 https://localhost/ 
    Trying ::1... 
TCP_NODELAY set 
Connected to localhost (::1) port 443 (#0) 
ALPN, offering h2 
ALPN, offering http/1.1 
Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH 
successfully set certificate verify locations: 
    CAfile: /etc/ssl/cert.pem 
CApath: none 
TLSv1.2 (OUT), TLS handshake, Client hello (1): 
TLSv1.2 (IN), TLS handshake, Server hello (2): 
TLSv1.2 (IN), TLS handshake, Certificate (11): 
TLSv1.2 (IN), TLS handshake, Server key exchange (12): 
TLSv1.2 (IN), TLS handshake, Server finished (14): 
TLSv1.2 (OUT), TLS handshake, Client key exchange (16): 
TLSv1.2 (OUT), TLS change cipher, Client hello (1): 
TLSv1.2 (OUT), TLS handshake, Finished (20): 
TLSv1.2 (IN), TLS change cipher, Client hello (1): 
TLSv1.2 (IN), TLS handshake, Finished (20): 
SSL connection using TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384 
ALPN, server accepted to use http/1.1 
Server certificate: 
subject: C=CL; ST=Valparaiso; L=Hanga Roa; O=Hereveri Blog; CN=localhost; [email protected] 
start date: Oct 10 17:51:15 2017 GMT 
expire date: Oct 20 17:51:15 2018 GMT 
subjectAltName: host "localhost" matched cert's "localhost" 
issuer: C=CL; ST=Valparaiso; O=Hereveri Blog; CN=Hereveri Blog Intermediate; [email protected] 
SSL certificate verify ok. 
GET/HTTP/1.1 
Host: localhost 
User-Agent: curl/7.54.0 
Accept: */* 

HTTP/1.1 200 OK 
Date: Wed, 11 Oct 2017 04:44:05 GMT 
Server: Apache/2.4.27 (Unix) LibreSSL/2.2.7 PHP/7.1.7 
Strict-Transport-Security: max-age=15768000 
Upgrade: h2 
Connection: Upgrade 
Last-Modified: Wed, 11 Oct 2017 03:52:53 GMT 
ETag: "72-55b3d5bb0cf40" 
Accept-Ranges: bytes 
Content-Length: 114 
Vary: Accept-Encoding 
Content-Type: text/html

我用的OpenSSL的LibreSSL 2.2.7版本生成我的证书和Apache/2.4.27服务器，在MacOS上高塞拉利昂提供。

虚拟主机配置：

Listen 443 https 

<VirtualHost *:443> 
    ProtocolsHonorOrder On 
    Protocols h2 http/1.1 
    H2Direct on 
    ServerAdmin [email protected] 
    DocumentRoot "/Users/nelson/localhost" 
    ServerName localhost 
    ErrorLog "/Users/nelson/logs/localhost-secure-error_log" 
    CustomLog "/Users/nelson/logs/localhost-secure-access_log" common 
    SSLEngine on 
    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK 
    SSLProtocol All -SSLv2 -SSLv3 
    SSLCertificateFile /etc/apache2/ssl/localhost.crt 
    SSLCertificateKeyFile /etc/apache2/ssl/localhost.key 
    SSLCertificateChainFile /etc/apache2/ssl/ca-chain.crt 
    Header always set Strict-Transport-Security "max-age=15768000" 
</VirtualHost>

我检查SSL connection using TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384对TLS 1.2 Cipher Suite Black List。

并用该密码测试openssl。

$ openssl s_client -connect localhost:443 -alpn 'h2' 
CONNECTED(00000005) 
depth=2 C = CL, ST = Valparaiso, L = Hanga Roa, O = Hereveri Blog, CN = Hereveri Blog, emailAddress = [email protected] 
verify error:num=19:self signed certificate in certificate chain 
verify return:0 
--- 
Certificate chain 
0 s:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri  Blog/CN=localhost/[email protected] 
    i:/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog Intermediate/[email protected] 
1 s:/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog Intermediate/[email protected] 
    i:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri Blog/[email protected] 
2 s:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri Blog/[email protected] 
    i:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri Blog/[email protected] 
--- 
Server certificate 
-----BEGIN CERTIFICATE----- 
MIIF/jCCA+agAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYQxCzAJBgNVBAYTAkNM 
MRMwEQYDVQQIDApWYWxwYXJhaXNvMRYwFAYDVQQKDA1IZXJldmVyaSBCbG9nMSMw 
IQYDVQQDDBpIZXJldmVyaSBCbG9nIEludGVybWVkaWF0ZTEjMCEGCSqGSIb3DQEJ 
ARYUY29udGFjdG9AaGVyZXZlcmkuY2wwHhcNMTcxMDEwMTc1MTE1WhcNMTgxMDIw 
MTc1MTE1WjCBhzELMAkGA1UEBhMCQ0wxEzARBgNVBAgMClZhbHBhcmFpc28xEjAQ 
BgNVBAcMCUhhbmdhIFJvYTEWMBQGA1UECgwNSGVyZXZlcmkgQmxvZzESMBAGA1UE 
AwwJbG9jYWxob3N0MSMwIQYJKoZIhvcNAQkBFhRjb250YWN0b0BoZXJldmVyaS5j 
bDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMspMwmK2uXAagMr8Ehk 
MlbT65xsYGDMtMeKS7tHeREqyxDT4eFYhPxpaysZiYi8qVTV+UOXUIYMOVPSTOt5 
Pi3xZHEDI5ksQeN4SHEUORsC/TrdOzGnuok9xqRinetbw3lVCiIHT8J1YPuK1eqs 
IJkBfxxGsozeHtIqUUP9uCqJtee6RCLzCX5x9TyGHdzJ119IWBNvoCnjszfy5xce 
RA7tWiHLVADjYn2qP4Z+ygu3LO6YUhREiXSz0d2XeN2QkRVpjgtaQaRbMXjYVB3I 
Vl9qiCVv3s54N4hE3aTetlztwtfl6KiPowzGDXAimIkuMBWvfAJpxqMpvr/dCKkC 
SOsCAwEAAaOCAXMwggFvMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMG 
CWCGSAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNh 
dGUwHQYDVR0OBBYEFFXkNlktvmRpS86rRcXBeAKTaTtqMIG5BgNVHSMEgbEwga6A 
FGI2DKBocboYIepbP4Scj1qXI4TYoYGRpIGOMIGLMQswCQYDVQQGEwJDTDETMBEG 
A1UECAwKVmFscGFyYWlzbzESMBAGA1UEBwwJSGFuZ2EgUm9hMRYwFAYDVQQKDA1I 
ZXJldmVyaSBCbG9nMRYwFAYDVQQDDA1IZXJldmVyaSBCbG9nMSMwIQYJKoZIhvcN 
AQkBFhRjb250YWN0b0BoZXJldmVyaS5jbIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG 
A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATAN 
BgkqhkiG9w0BAQsFAAOCAgEARea21L8UrkpR93tksQEeo8NN6pTIbd/SFWL1BBfy 
t3IwmM6/mhFjMNGQ7hr7uG5N8c/JsJ9TGWq0pYZIgGe8WQNLC3PZaru8Nby4lu7i 
rYPOQgtAkZ1JiAHjGATTvnunkMT6xfIPj0DEZJ3p8J9ILt6oq0ZUVuj2fljJiZ/P 
P0s/LLi6qnTHP+DTJaqsqGVLotCvbGclf5AJD+ru0mKrAH7HCRm2zTI/R5dKiQaQ 
zEV6zQDvSsVsCWOAupKVGvzeqJkNdMYsH04vebrSX2jWlJyr/qP4a4CCjVqyVe8H 
vr9C7811Bqa713ewspEEorc8KnAbdE6X3/x+OoxSX9r4tnY2Yz81U05ifCrYJFGh 
TrBZDZtthm0o+dUsL+mgey02qZ1gEvry2+mfRllzE2n7/yP8fP6or3cI3T9zsXhS 
KN8k9XapnuDKsflHrwg9NhjCvKkLjErCMot6m4EB+P0od4xllRi5hztKUrwMxuN9 
Sjwgvemxjf4w9FYEmOFTLQUD77BPi7Kgas+UtV76a0J2x/vrpS+lTy5ds4OqsmMs 
WcEk/aH3R4dtQbuPA4m+GVw1poiZMMLCu4rsbu8Yz+nvABeKgZcym4SxgKsZYepn 
EXunpihZ9+2ocn6y550LMasJsgvtNgoqh5xfeRknqEfHF0SMQIheBRAyrluIg2TX 
uaI= 
-----END CERTIFICATE----- 
subject=/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=localhost/[email protected] 
issuer=/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog  Intermediate/[email protected] 
--- 
No client certificate CA names sent 
--- 
SSL handshake has read 5390 bytes and written 533 bytes 
--- 
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 
Server public key is 2048 bit 
Secure Renegotiation IS supported 
Compression: NONE 
Expansion: NONE 
ALPN protocol: http/1.1 
SSL-Session: 
    Protocol : TLSv1.2 
    Cipher : ECDHE-RSA-AES256-GCM-SHA384 
    Session-ID: 13230CAD937A6B82AE34F5E6730E6BFF154ECA2E391BB36D8F589BCDD36C1749 
    Session-ID-ctx: 
    Master-Key: A801C895B29E56182A97A6ADC4C6A798CA4B94F2BAA1A25D71D4669C4B4D58175D6C5A840C74 AFDCFE15237CD62CE7CF 
    TLS session ticket lifetime hint: 300 (seconds) 
    TLS session ticket: 
    0000 - 05 b3 94 9b 42 7d 90 6c-47 32 d7 8a fb 56 f2 41 ....B}.lG2...V.A 
    0010 - e0 b5 4a b4 5b 7c 21 cc-ec b9 11 a1 04 27 d7 2d ..J.[|!......'.- 
    0020 - 3d 23 0b f8 4a 75 dc 5c-bb b0 c3 0c c4 3b 2e 4b =#..Ju.\.....;.K 
    0030 - 02 4f 89 1a 6d bf ec ca-e2 d1 a3 7c 47 36 70 54 .O..m......|G6pT 
    0040 - 2e ca eb d7 c9 26 76 c6-1f a9 d0 07 33 ae 99 ca .....&v.....3... 
    0050 - 27 f5 cc e3 56 0a 1c 27-66 5c a4 0f a8 f4 8a 07 '...V..'f\...... 
    0060 - c0 3b 68 28 37 cf a0 48-38 41 7c 47 f2 fb af 13 .;h(7..H8A|G.... 
    0070 - 40 d8 9e 8e 1f dc 6d 90-9f c3 af d7 7d 40 00 ce @.....m.....}@.. 
    0080 - cb 79 a4 66 cf 92 37 af-3b 75 aa 16 5f 63 4f 9c .y.f..7.;u.._cO. 
    0090 - 74 d2 a9 36 5f 04 4f a6-a7 b8 3c d3 ae 97 88 16 t..6_.O...<..... 
    00a0 - 2d 9e aa e7 60 24 52 43-4b ce 9a 2d 0c 19 49 8f -...`$RCK..-..I. 
    00b0 - 2f 26 31 da cf 08 a4 d7-f7 23 4f 83 94 82 67 d6 /&1......#O...g. 

    Start Time: 1507777559 
    Timeout : 300 (sec) 
    Verify return code: 0 (ok) 
---

一些核心：调试行：

protocol.c(2220): [client ::1:52046] AH03155: select protocol from h2,http/1.1, choices=h2,http/1.1 for server localhost 
protocol.c(2264): [client ::1:52046] AH03156: select protocol, proposals=http/1.1 preferences=h2,http/1.1 configured=h2,http/1.1 
protocol.c(2284): [client ::1:52046] AH03157: selected protocol=http/1.1

任何提示？提前致谢！

来源

2017-10-11 nhereveri

看起来不错，从Apache侧的最后阶段。你有没有尝试从浏览器而不是Curl连接来确认服务器问题还是你的curl设置？ –

是的，我愿意。我在Chrome，Canary，Firefox和Safari中获得了相同的协议http/1.1。 – nhereveri

很奇怪。 Apache错误日志中的任何内容？ –

简短回答： 我认为你需要LibreSSL 2.5或以上版本。

较长的答案：

看你的调试行：

protocol.c(2220): [client ::1:52046] AH03155: select protocol from h2,http/1.1, choices=h2,http/1.1 for server localhost

这意味着你的服务器提供h2,http/1.1（其中第一个）和您的客户端可以从它知道的协议选择（第二个h2,http/1.1）。所以这一切都看起来很好。

protocol.c(2264): [client ::1:52046] AH03156: select protocol, proposals=http/1.1 preferences=h2,http/1.1 configured=h2,http/1.1

这很有趣。在这个调试行中，客户端的协议列表被剥离了所有未知的协议 - 直到服务器支持的协议。

所以客户名单从h2,http/1.1下降到只有http/1.1。但服务器确实支持h2 - 那么为什么要删除它？我猜这是因为TLS库（LibreSSL）对H2没有任何了解。

我通过向客户端和服务器添加随机协议（H3，H4）来测试它，并且发现即使它们都支持它也会被剥离。

现在的how to h2 in apache页面确实需要ALPN，因此适用于“LibreSSL 2.1.3及更高版本”。而LibreSSL changelog并说：

2.1.3 - 安全更新和操作系统的支持改进

添加的应用层协议谈判（ALPN）的支持。

但是它也说：

2.5。0 - 新的API，错误修复和改进

libtls现在支持ALPN和SNI

后来我发现this issue这表明ALPN开始（也许在2.1.3？），但尚未完成直到2016年8月之后 - 在2.5.0发布之前。

我没有做编译Apache与LibreSSL的两个版本，以确认，但总得留下点什么给你做;-)

来源

2017-10-18 20:05:54

* OpenSSL 1.1.1-dev *失败。 '/ usr/local/bin/openssl s_client -connect localhost：443 -servername localhost -alpn spdy/2，h2，h2-14 -cipher“ECDHE-RSA-AES256-GCM-SHA384”| grep ALPN'。我尝试LibreSSL，只需要建立一些依赖关系。 – nhereveri

您需要使用OpenSSL 1.0.2或更高版本或LibreSSL 2.5或更高版本来重建Apache。从我看来，你刚刚使用openssl 1.1.1作为客户端，但问题是Apache编译的LibreSSL版本。 –

感谢您澄清。我想到这仅仅是为了生成证书而使用的openssl。 – nhereveri

在apache 2中启用HTTP/2

回答

相关问题