Is HTTP/2 supported?

Q: Is HTTP/2 supported?

Yes, on an HTTP vService. HTTP/2 is enabled independently on two connections: between the client and TR7, by selecting HTTP/2 as the Protocol in the frontend row of the vService and binding a Certificate; between TR7 and the Backend Service, by turning on SSL Service on the Backend Service and selecting HTTP 2.0 Enabled in the ALPN field or, for a server listening for unencrypted HTTP/2 (h2c), by leaving SSL Service off and checking Cleartext HTTP/2 (h2c). Clients that do not support HTTP/2 continue to connect to the same row with HTTP/1.1. The default connection to the Backend Service is HTTP/1.1.

Short answer

Yes, on an HTTP vService. HTTP/2 is enabled independently on two connections: between the client and TR7, by selecting HTTP/2 as the Protocol in the frontend row of the vService and binding a Certificate; between TR7 and the Backend Service, by turning on SSL Service on the Backend Service and selecting HTTP 2.0 Enabled in the ALPN field or, for a server listening for unencrypted HTTP/2 (h2c), by leaving SSL Service off and checking Cleartext HTTP/2 (h2c). Clients that do not support HTTP/2 continue to connect to the same row with HTTP/1.1. The default connection to the Backend Service is HTTP/1.1.

Problem: Why Is HTTP/2 Not Enabled Automatically?

Browsers negotiate HTTP/2 with ALPN in the TLS handshake; therefore, HTTP/2 is not offered on an unencrypted frontend row. A newly added frontend row comes with port 80 and the unencrypted HTTP protocol; a row with HTTP/1.1 selected also offers only HTTP/1.1 to the client. The connection TR7 opens to the Backend Service is also HTTP/1.1 by default. For HTTP/2 on the client side, the protocol of the row is changed; for HTTP/2 on the Backend Service side, the SSL settings of the Backend Service or the Cleartext HTTP/2 (h2c) setting is changed.

Solution: Two Settings for Two Connections

The two settings are independent of each other; the client side can be enabled on its own. The Backend Service side is enabled only if the application requires HTTP/2 (e.g. gRPC).

Your situation	Suitable method
Browsers should connect to the site with HTTP/2	Method 1: HTTP/2 between the client and TR7
The Backend Service should also talk HTTP/2 (like gRPC)	Method 1 + Method 2: HTTP/2 between TR7 and the Backend Service

Method 1: HTTP/2 Between the Client and TR7 Recommended

How it works In the TLS handshake, TR7 offers HTTP/2 and HTTP/1.1 to the client; the client selects the version it supports.
Where it is opened vService → Frontend → Protocol → Encrypted (HTTPS) → HTTP/2
Requirement A certificate uploaded to TR7 and bound to the row
vService type HTTP only

Step-by-Step Configuration

Adım 1 Open the certificate add form (if it is not on TR7)

If the certificate of the domain name is not on TR7, the Certificates & PKI → SSL/TLS Certificates → Add steps are followed (how to add).

Adım 2 Enter the certificate fields

Certificate Name is entered. For separate PEM files, Type = Manual is selected and the certificate and the private key are pasted into the Certificate Content and Key Content fields; for a PFX file, PFX is selected, the file is selected from the PFX File field and the password of the file is entered in the Password field. Details: How do I upload my certificate to TR7; which formats are supported?

Adım 3 Save the certificate

The Add button at the bottom of the form is clicked.

Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService of type HTTP is selected and the Edit button is clicked.

Adım 5 Add the 443 row (if none exists)

If there is no row with port 443 in the Frontend table, a new row is added with the (+) icon in the table header; the row comes with port 80 and the HTTP protocol. The IP is selected and the port is set to 443.

Adım 6 Select HTTP/2 as the Protocol

In the Protocol field of the row with port 443, HTTP/2 is selected from the Encrypted (HTTPS) group. When an encrypted protocol is selected, the Certificate field appears in the form.

Adım 7 Select the certificate

The certificate of the domain name is selected from the Certificate field. The form does not prevent saving without a certificate; however, if no certificate is selected, the row listens for unencrypted HTTP and HTTP/2 is not offered.

Adım 8 Redirect port 80 (optional)

If a second row with port 80 is added for the same IP and HTTP → HTTPS is selected from the Redirect group as the Protocol, clients arriving unencrypted are redirected to HTTPS with 301.

Adım 9 Save

The Save button is clicked. The record is saved immediately; the progress of applying it is followed from the sync indicator at the bottom right of the screen. In a cluster setup, the change is also transferred to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

No change is required on the Backend Service side: TR7 continues to connect to the Backend Service with HTTP/1.1 by default.

Verification

1With curlClient side

Commandcurl -vI --http2 https://www.example.com

ExpectedALPN: server accepted h2 · HTTP/2 200

In the browser, h2 appears in the Protocol column on the Developer Tools → Network tab.

2With HTTP LogsTR7 side

The Request column of the request is examined on the HTTP Logs screen of the vService.

ExpectedGET HTTP/2.0 https://www.example.com/

Method 2: HTTP/2 Between TR7 and the Backend Service

How it works TR7 connects to the Backend Service with TLS and offers HTTP/2 with ALPN; if the Backend Service supports it, the connection becomes HTTP/2, and if it does not, it continues with HTTP/1.1. To a server listening for unencrypted HTTP/2 (h2c), on the other hand, it connects directly with HTTP/2, without TLS.
Where it is opened Backend Service → SSL Service → ALPN → HTTP 2.0 Enabled; on an unencrypted server, Backend Service → Cleartext HTTP/2 (h2c)
Requirement The Backend Service serving HTTP/2 over TLS or unencrypted HTTP/2 (h2c)
vService type HTTP

Step-by-Step Configuration

Adım 1 Open the Backend Service edit form

On the Load Balancer → Backend Services screen, the Backend Service is selected and the Edit button is clicked.

Adım 2 Check the address for the TLS port

The port in the Address field must be the port on which the server listens for TLS (HTTPS) (e.g. 192.0.2.20:443); a TLS connection cannot be made to an unencrypted port.

Adım 3 Turn on SSL Service

SSL Service is turned on; TR7 connects to the Backend Service with TLS.

Adım 4 Select HTTP 2.0 Enabled in ALPN

HTTP 2.0 Enabled is selected in the ALPN field. This field appears together with the SSL Service settings.

Adım 5 Save

The Edit button at the bottom of the form is clicked. All the vServices that use the Backend Service work with this setting. In a cluster setup, the change is also transferred to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

On the Backend Service side: The server must be configured to serve HTTP/2 over TLS (h2 in ALPN); with a server that serves only HTTP/1.1, the connection continues as HTTP/1.1.

Unencrypted HTTP/2 (h2c): If the server listens for HTTP/2 without TLS, instead of steps 2-4, the port in the Address field is left as the unencrypted port of the server, SSL Service stays off, and Cleartext HTTP/2 (h2c) is checked. In this connection, each connection starts directly as HTTP/2 and does not fall back to HTTP/1.1. If the health check is HTTP, HTTP/2 is selected in the HTTP Version field of the Health Checks profile.

Verification

1With the access logBackend Service side

The protocol version of the requests coming from TR7 is checked in the access log of the Backend Service.

Expected"GET / HTTP/2.0" 200

Common Mistakes

Not selecting a certificate. If there is no certificate in a row with HTTP/2 selected, the row listens for unencrypted HTTP.
Using the Keep Header Names action. On a vService to which this action is bound, HTTP/2 is turned off on both the client and the Backend Service side, and the warning "Keep header names is active on this vService: … turned off" appears in the vService status.
Looking for HTTP/2 on an L7 TCP vService. The protocol options of L7 TCP are only TCP and TCP + TLS; HTTP/2 exists only on the HTTP vService.
Turning on SSL Service on an unencrypted HTTP/2 (h2c) server. For a server listening for HTTP/2 without TLS, SSL Service is left off and Cleartext HTTP/2 (h2c) is checked; this field is not displayed in the form while SSL Service is checked, and it is effective only on HTTP vServices.

How it is done in the documentation

Is HTTP/2 supported? ​

Problem: Why Is HTTP/2 Not Enabled Automatically? ​

Solution: Two Settings for Two Connections ​

Method 1: HTTP/2 Between the Client and TR7 Recommended ​

Step-by-Step Configuration ​

Verification ​

Method 2: HTTP/2 Between TR7 and the Backend Service ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​

Is HTTP/2 supported?

Problem: Why Is HTTP/2 Not Enabled Automatically?

Solution: Two Settings for Two Connections

Method 1: HTTP/2 Between the Client and TR7 Recommended

Step-by-Step Configuration

Verification

Method 2: HTTP/2 Between TR7 and the Backend Service

Step-by-Step Configuration

Verification

Common Mistakes