HTTP/2 configuration in Nginx - Step-by-Step Execution

Process Flow - HTTP/2 configuration

Start nginx config

↓

Enable listen on port 443 with ssl and http2

↓

Add ssl_certificate and ssl_certificate_key

↓

Reload nginx to apply changes

↓

Client connects using HTTP/2 protocol

↓

Server responds with HTTP/2 features enabled

↓

Connection established with HTTP/2 benefits

↓

End

The flow shows enabling HTTP/2 in nginx by configuring SSL and the listen directive, then reloading nginx to apply and serve HTTP/2 connections.

Execution Sample

Nginx

server {
    listen 443 ssl http2;
    ssl_certificate /etc/ssl/certs/example.crt;
    ssl_certificate_key /etc/ssl/private/example.key;
}

This nginx server block enables HTTP/2 on port 443 with SSL certificates configured.

Process Table

Step	Action	Configuration Line	Result
1	Start nginx configuration	server {	Begin server block
2	Enable listen on port 443 with ssl and http2	listen 443 ssl http2;	nginx listens on 443 with HTTP/2 enabled
3	Add SSL certificate path	ssl_certificate /etc/ssl/certs/example.crt;	SSL certificate path set
4	Add SSL certificate key path	ssl_certificate_key /etc/ssl/private/example.key;	SSL key path set
5	Close server block	}	Server block closed
6	Reload nginx	nginx -s reload	nginx reloads configuration successfully
7	Client connects	curl --http2 https://example.com	Connection uses HTTP/2 protocol
8	Verify HTTP/2	curl -I --http2 https://example.com	Response headers received over HTTP/2

💡 Configuration applied and nginx reload completed; HTTP/2 enabled on port 443 with SSL

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
listen_directive	none	443 ssl http2	443 ssl http2	443 ssl http2	443 ssl http2
ssl_certificate	none	none	/etc/ssl/certs/example.crt	/etc/ssl/certs/example.crt	/etc/ssl/certs/example.crt
ssl_certificate_key	none	none	none	/etc/ssl/private/example.key	/etc/ssl/private/example.key
nginx_status	running with old config	running with old config	running with old config	running with old config	running with new config

Key Moments - 3 Insights

Why do we need to include both 'ssl' and 'http2' in the listen directive?

Because HTTP/2 in nginx requires SSL to be enabled on the port; 'ssl' enables encryption and 'http2' enables the protocol. See execution_table step 2.

What happens if we reload nginx without the correct SSL certificate paths?

Nginx will fail to reload or start properly because SSL certificates are required for HTTPS and HTTP/2. This is shown in execution_table steps 3 and 4 where paths are set.

How can we verify that HTTP/2 is actually used by the client?

By using a client command like 'curl --http2' and checking the response headers, as shown in execution_table steps 7 and 8.

Visual Quiz - 3 Questions

Look at the execution table, at which step is HTTP/2 enabled in the nginx configuration?

A Step 6

B Step 3

C Step 2

D Step 7

💡 Hint

Check the 'Configuration Line' column for 'listen 443 ssl http2;' in the execution_table.

According to the variable tracker, what is the value of 'nginx_status' after step 6?

A running with new config

B stopped

C running with old config

D reloading

💡 Hint

Look at the 'nginx_status' row under 'After Step 6' in the variable_tracker.

If the SSL certificate path is missing, which step in the execution_table would fail?

A Step 2

B Step 6

C Step 3

D Step 7

💡 Hint

Refer to the key moment about nginx reload failure and the execution_table step where reload happens.

Concept Snapshot

nginx HTTP/2 Configuration:
- Use 'listen 443 ssl http2;' in server block
- Set 'ssl_certificate' and 'ssl_certificate_key' paths
- Reload nginx with 'nginx -s reload'
- Verify HTTP/2 with 'curl --http2'
- HTTP/2 requires SSL to be enabled

Full Transcript

To enable HTTP/2 in nginx, you add 'http2' to the listen directive along with 'ssl' on port 443. You must specify the SSL certificate and key paths. After saving the configuration, reload nginx to apply changes. Clients connecting with HTTP/2 will benefit from faster and more efficient communication. You can verify HTTP/2 usage by using curl with the --http2 option. This process ensures secure and modern web connections.

Practice

1. What is the correct way to enable HTTP/2 in an nginx server block?

easy

A. Add http2 to the location block

B. Add http2 to the server_name directive

C. Add http2 to the listen directive with SSL enabled

D. Add http2 to the root directive

Solution

1. Step 1: Understand HTTP/2 enabling in nginx

   HTTP/2 is enabled by adding the http2 parameter to the listen directive, which must be used with SSL (HTTPS).

2. Step 2: Identify correct directive usage

   The http2 parameter does not belong in server_name, root, or location blocks.

3. Final Answer:

   Add http2 to the listen directive with SSL enabled -> Option C

4. Quick Check:

   Enable HTTP/2 by adding http2 to listen with SSL [OK]

Hint: Add 'http2' only in listen directive with SSL [OK]

Common Mistakes:

• Adding http2 to server_name or root directives
• Forgetting to enable SSL when using http2
• Placing http2 inside location blocks

2. Which of the following is the correct syntax to enable HTTP/2 on port 443 in nginx?

easy

A. listen 443 ssl;

B. listen http2 443 ssl;

C. listen 443 http2;

D. listen 443 ssl http2;

Solution

1. Step 1: Review nginx listen directive syntax

   The correct order is listen [port] ssl http2; to enable SSL and HTTP/2 on the port.

2. Step 2: Check each option

   listen 443 ssl http2; uses correct syntax: listen 443 ssl http2;. listen http2 443 ssl; reverses order but is invalid. listen 443 ssl; misses http2. listen 443 http2; misses ssl, which is required for http2.

3. Final Answer:

   listen 443 ssl http2; -> Option D

4. Quick Check:

   Correct syntax is 'listen 443 ssl http2;' [OK]

Hint: Use 'listen 443 ssl http2;' exactly for HTTP/2 [OK]

Common Mistakes:

• Omitting ssl when enabling http2
• Placing http2 before ssl in listen directive
• Using http2 without SSL on port 443

3. Given this nginx server block snippet, what will happen when a client connects?

server {
    listen 443 ssl http2;
    ssl_certificate /etc/ssl/cert.pem;
    ssl_certificate_key /etc/ssl/key.pem;
    server_name example.com;
}

medium

A. The server will accept HTTPS connections using HTTP/2 protocol

B. The server will accept HTTP connections only, no HTTP/2

C. The server will reject connections due to missing http2 directive

D. The server will accept HTTPS but use HTTP/1.1 only

Solution

1. Step 1: Analyze listen directive

   The listen directive includes ssl and http2, enabling HTTPS with HTTP/2 support.

2. Step 2: Confirm SSL certificates presence

   SSL certificate and key files are specified, so HTTPS can work properly.

3. Final Answer:

   The server will accept HTTPS connections using HTTP/2 protocol -> Option A

4. Quick Check:

   listen with ssl and http2 means HTTPS + HTTP/2 enabled [OK]

Hint: ssl + http2 in listen means HTTPS with HTTP/2 [OK]

Common Mistakes:

• Assuming HTTP/2 works without ssl
• Confusing HTTP and HTTPS ports
• Ignoring the http2 parameter in listen

4. You added http2 to your nginx listen directive but HTTP/2 is not working. Which configuration mistake could cause this?

medium

A. Forgetting to enable SSL (missing ssl in listen directive)

B. Using http2 in the server_name directive

C. Setting listen to port 80 with http2

D. Adding http2 inside the location block

Solution

1. Step 1: Understand HTTP/2 requirements in nginx

   HTTP/2 requires SSL (HTTPS) to be enabled in nginx; without ssl in the listen directive, HTTP/2 won't work.

2. Step 2: Evaluate other options

   Options A, C, and D are invalid uses of http2 but the main cause is missing SSL.

3. Final Answer:

   Forgetting to enable SSL (missing ssl in listen directive) -> Option A

4. Quick Check:

   HTTP/2 needs SSL enabled in listen directive [OK]

Hint: Always include ssl with http2 in listen directive [OK]

Common Mistakes:

• Not enabling ssl with http2
• Placing http2 in wrong directives
• Trying http2 on port 80 without ssl

5. You want to configure nginx to serve HTTP/2 on port 443 and redirect all HTTP (port 80) traffic to HTTPS. Which configuration snippet correctly achieves this?

hard

A. server {
listen 80 http2;
return 301 https://$host$request_uri;
}

server {
listen 443 ssl;
server_name example.com;
}

B. server {
listen 80;
return 301 https://$host$request_uri;
}

server {
listen 443 ssl http2;
ssl_certificate /etc/ssl/cert.pem;
ssl_certificate_key /etc/ssl/key.pem;
server_name example.com;
}

C. server {
listen 443 ssl http2;
server_name example.com;
}

server {
listen 80 ssl http2;
return 301 https://$host$request_uri;
}

D. server {
listen 443 ssl;
ssl_certificate /etc/ssl/cert.pem;
ssl_certificate_key /etc/ssl/key.pem;
server_name example.com;
}

server {
listen 80;
return 301 https://$host$request_uri;
}

Solution

1. Step 1: Redirect HTTP to HTTPS on port 80

   The first server block listens on port 80 without SSL and redirects all requests to HTTPS using a 301 redirect.

2. Step 2: Enable HTTPS with HTTP/2 on port 443

   The second server block listens on port 443 with ssl and http2 enabled, and specifies SSL certificates.

3. Step 3: Verify other options

   server {
       listen 80 http2;
       return 301 https://$host$request_uri;
   }
   
   server {
       listen 443 ssl;
       server_name example.com;
   }

   incorrectly enables http2 on port 80 (no SSL).

   server {
       listen 443 ssl http2;
       server_name example.com;
   }
   
   server {
       listen 80 ssl http2;
       return 301 https://$host$request_uri;
   }

   enables SSL and http2 on port 80 which is invalid.

   server {
       listen 443 ssl;
       ssl_certificate /etc/ssl/cert.pem;
       ssl_certificate_key /etc/ssl/key.pem;
       server_name example.com;
   }
   
   server {
       listen 80;
       return 301 https://$host$request_uri;
   }

   misses http2 on port 443.

4. Final Answer:

   The configuration correctly redirects HTTP to HTTPS and enables HTTP/2 on HTTPS -> Option B

5. Quick Check:

   Redirect HTTP on 80, enable SSL+http2 on 443 [OK]

Hint: Redirect HTTP on 80, enable SSL+http2 on 443 [OK]

Common Mistakes:

• Enabling http2 on port 80 without SSL
• Missing http2 on HTTPS server block
• Not redirecting HTTP to HTTPS properly