Is HTTP/3 (QUIC) supported; how is it enabled and which conditions does it depend on?

Q: Is HTTP/3 (QUIC) supported; how is it enabled and which conditions does it depend on?

Yes, in an HTTP vService and as an additional protocol. In the Protocol field of the frontend row, an option with the HTTP/3 badge (HTTP/1.1 or HTTP/2 + HTTP/3) is selected from the Encrypted (HTTPS) group: TR7 listens on the same IP:port over TCP for HTTP/1.1 or HTTP/2 and over UDP for QUIC (HTTP/3), and moves supporting clients to HTTP/3 by adding the alt-svc header to responses. Conditions: a Certificate must be selected in the row, the Virtual Hosting list of the vService must be empty, the Core Engine must support QUIC, the Keep Header Names action must not be bound to the vService, and the UDP port must be open on the firewall in front of TR7.

Short answer

Yes, in an HTTP vService and as an additional protocol. In the Protocol field of the frontend row, an option with the HTTP/3 badge (HTTP/1.1 or HTTP/2 + HTTP/3) is selected from the Encrypted (HTTPS) group: TR7 listens on the same IP:port over TCP for HTTP/1.1 or HTTP/2 and over UDP for QUIC (HTTP/3), and moves supporting clients to HTTP/3 by adding the alt-svc header to responses. Conditions: a Certificate must be selected in the row, the Virtual Hosting list of the vService must be empty, the Core Engine must support QUIC, the Keep Header Names action must not be bound to the vService, and the UDP port must be open on the firewall in front of TR7.

Problem: Why Does HTTP/3 Depend on Separate Conditions?

HTTP/3 uses the QUIC protocol, which runs over UDP instead of TCP. The client first connects to the site over TCP (HTTP/1.1 or HTTP/2), learns from the alt-svc header in the response that the site offers HTTP/3, and switches to UDP in subsequent connections. For this reason, HTTP/3 is not offered on its own but alongside the HTTPS protocol in the same row; UDP traffic must be open along the path, and the selected Core Engine version must support QUIC.

Solution

Enabling HTTP/3 on an HTTP vService

How it works The protocol selected over TCP continues to be offered; QUIC over UDP is added on the same IP:port. TR7 automatically adds the alt-svc: h3=":443"; ma=900 header to responses and its own firewall rule for the UDP port.
Where it is opened vService → Frontend → Protocol → Encrypted (HTTPS) → option with the HTTP/3 badge
Requirement Certificate · empty Virtual Hosting list · a Core Engine that supports QUIC · the Keep Header Names action not being bound · UDP port on the external firewall
vService type HTTP only
Backend Service side No change is required; HTTP/3 is only between the client and TR7.

Step-by-Step Configuration

Adım 1 Open the UDP port on the network

If there is another firewall or NAT device in front of TR7, the UDP port of the vService address (e.g. UDP 443) is allowed. TR7 adds its own firewall rule automatically.

Adım 2 Open the certificate add form (if it is not on TR7)

If the certificate is not on TR7, the Certificates & PKI → SSL/TLS Certificates → Add steps are followed (how to add).

Adım 3 Enter the certificate fields

Certificate Name is entered. For separate PEM files, Type = Manual is selected and the certificate and the private key are pasted into the Certificate Content and Key Content fields; for a PFX file, PFX is selected, the file is selected from the PFX File field and the password of the file is entered in the Password field. Details: How do I upload my certificate to TR7; which formats are supported?

Adım 4 Save the certificate

The Add button at the bottom of the form is clicked.

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService of type HTTP is selected and the Edit button is clicked.

Adım 6 Check the Virtual hosting list

The Virtual Hosting switch must be off and the list must be empty. While there is a domain name in the list, options with the HTTP/3 badge are not shown; when the first domain name is added to the list, the existing HTTP/3 selection is removed. If virtual hosting is needed, HTTP/3 cannot be used on the same IP:port.

Adım 7 Select the protocol with the HTTP/3 badge

In the Protocol field of the row with port 443, an option with the HTTP/3 badge (e.g. HTTP/2 + HTTP/3) is selected from the Encrypted (HTTPS) group. The frontend port must be a single port; in a row where a range is entered, the alt-svc header is not added.

Adım 8 Select the certificate

In the Certificate field, the certificate of the domain name is selected. In a row without a certificate, neither HTTPS nor HTTP/3 is offered.

Adım 9 Check the core engine

The default Core engine version supports QUIC. If a different version was selected in the vService, the Details switch at the top right of the form is turned on, the QOS box is checked, and a version whose name contains QUIC is selected in the Core Engine field.

Adım 10 Save

The Save button is clicked. The progress of applying the change is followed from the sync indicator at the bottom right of the screen. In a cluster setup, the change is also transferred to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1alt-svc headerClient side

Commandcurl -sI https://www.example.com | grep -i alt-svc

Expectedalt-svc: h3=":443"; ma=900

2HTTP/3 connectionClient side

Commandcurl -I --http3-only https://www.example.com

ExpectedHTTP/3 200

A curl version with HTTP/3 support is required. In the browser, h3 appears in the Developer Tools → Network → Protocol column when the page is loaded a second time.

3vService status messageTR7 side

The row is clicked in the vService list; the status messages in the Details tab of the preview that opens on the right are examined.

ExpectedNo "The selected core engine does not support: HTTP/3 (QUIC)" or "Keep header names is active…" warning

Common Mistakes

Not opening UDP on the external firewall. TCP works, HTTP/3 is not established; clients stay on HTTP/2 or HTTP/1.1.
Using it together with virtual hosting. In a vService whose Virtual Hosting list is filled in, options with the HTTP/3 badge are not offered.
Selecting a Core engine that does not support QUIC. If the selected Core Engine does not support QUIC, HTTP/3 is not applied; the message "The selected core engine does not support: HTTP/3 (QUIC)" appears in the vService status.
Binding the Keep header names action. In a vService to which Keep Header Names is bound, HTTP/3 is turned off and the warning "Keep header names is active on this vService: … turned off" appears in the vService status.
Using a port range. If the frontend port is entered as a range, the alt-svc header is not added.
Thinking HTTP/3 is a standalone protocol. HTTP/3 is always offered alongside the HTTPS protocol over TCP; the client establishes the first connection over TCP.

How it is done in the documentation

Is HTTP/3 (QUIC) supported; how is it enabled and which conditions does it depend on? ​

Problem: Why Does HTTP/3 Depend on Separate Conditions? ​

Solution ​

Enabling HTTP/3 on an HTTP vService ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​