在apache 2中启用HTTP/2
我的apache配置有问题。服务器不与HTTP/2回应:在apache 2中启用HTTP/2
$ curl -v --http2 https://localhost/
Trying ::1...
TCP_NODELAY set
Connected to localhost (::1) port 443 (#0)
ALPN, offering h2
ALPN, offering http/1.1
Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
successfully set certificate verify locations:
CAfile: /etc/ssl/cert.pem
CApath: none
TLSv1.2 (OUT), TLS handshake, Client hello (1):
TLSv1.2 (IN), TLS handshake, Server hello (2):
TLSv1.2 (IN), TLS handshake, Certificate (11):
TLSv1.2 (IN), TLS handshake, Server key exchange (12):
TLSv1.2 (IN), TLS handshake, Server finished (14):
TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
TLSv1.2 (OUT), TLS change cipher, Client hello (1):
TLSv1.2 (OUT), TLS handshake, Finished (20):
TLSv1.2 (IN), TLS change cipher, Client hello (1):
TLSv1.2 (IN), TLS handshake, Finished (20):
SSL connection using TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384
ALPN, server accepted to use http/1.1
Server certificate:
subject: C=CL; ST=Valparaiso; L=Hanga Roa; O=Hereveri Blog; CN=localhost; [email protected]
start date: Oct 10 17:51:15 2017 GMT
expire date: Oct 20 17:51:15 2018 GMT
subjectAltName: host "localhost" matched cert's "localhost"
issuer: C=CL; ST=Valparaiso; O=Hereveri Blog; CN=Hereveri Blog Intermediate; [email protected]
SSL certificate verify ok.
GET/HTTP/1.1
Host: localhost
User-Agent: curl/7.54.0
Accept: */*
HTTP/1.1 200 OK
Date: Wed, 11 Oct 2017 04:44:05 GMT
Server: Apache/2.4.27 (Unix) LibreSSL/2.2.7 PHP/7.1.7
Strict-Transport-Security: max-age=15768000
Upgrade: h2
Connection: Upgrade
Last-Modified: Wed, 11 Oct 2017 03:52:53 GMT
ETag: "72-55b3d5bb0cf40"
Accept-Ranges: bytes
Content-Length: 114
Vary: Accept-Encoding
Content-Type: text/html
我用的OpenSSL的LibreSSL 2.2.7
版本生成我的证书和Apache/2.4.27
服务器,在MacOS上高塞拉利昂提供。
虚拟主机配置:
Listen 443 https
<VirtualHost *:443>
ProtocolsHonorOrder On
Protocols h2 http/1.1
H2Direct on
ServerAdmin [email protected]
DocumentRoot "/Users/nelson/localhost"
ServerName localhost
ErrorLog "/Users/nelson/logs/localhost-secure-error_log"
CustomLog "/Users/nelson/logs/localhost-secure-access_log" common
SSLEngine on
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
SSLProtocol All -SSLv2 -SSLv3
SSLCertificateFile /etc/apache2/ssl/localhost.crt
SSLCertificateKeyFile /etc/apache2/ssl/localhost.key
SSLCertificateChainFile /etc/apache2/ssl/ca-chain.crt
Header always set Strict-Transport-Security "max-age=15768000"
</VirtualHost>
我检查SSL connection using TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384
对TLS 1.2 Cipher Suite Black List。
并用该密码测试openssl
。
$ openssl s_client -connect localhost:443 -alpn 'h2'
CONNECTED(00000005)
depth=2 C = CL, ST = Valparaiso, L = Hanga Roa, O = Hereveri Blog, CN = Hereveri Blog, emailAddress = [email protected]
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
0 s:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=localhost/[email protected]
i:/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog Intermediate/[email protected]
1 s:/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog Intermediate/[email protected]
i:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri Blog/[email protected]
2 s:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri Blog/[email protected]
i:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri Blog/[email protected]
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF/jCCA+agAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYQxCzAJBgNVBAYTAkNM
MRMwEQYDVQQIDApWYWxwYXJhaXNvMRYwFAYDVQQKDA1IZXJldmVyaSBCbG9nMSMw
IQYDVQQDDBpIZXJldmVyaSBCbG9nIEludGVybWVkaWF0ZTEjMCEGCSqGSIb3DQEJ
ARYUY29udGFjdG9AaGVyZXZlcmkuY2wwHhcNMTcxMDEwMTc1MTE1WhcNMTgxMDIw
MTc1MTE1WjCBhzELMAkGA1UEBhMCQ0wxEzARBgNVBAgMClZhbHBhcmFpc28xEjAQ
BgNVBAcMCUhhbmdhIFJvYTEWMBQGA1UECgwNSGVyZXZlcmkgQmxvZzESMBAGA1UE
AwwJbG9jYWxob3N0MSMwIQYJKoZIhvcNAQkBFhRjb250YWN0b0BoZXJldmVyaS5j
bDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMspMwmK2uXAagMr8Ehk
MlbT65xsYGDMtMeKS7tHeREqyxDT4eFYhPxpaysZiYi8qVTV+UOXUIYMOVPSTOt5
Pi3xZHEDI5ksQeN4SHEUORsC/TrdOzGnuok9xqRinetbw3lVCiIHT8J1YPuK1eqs
IJkBfxxGsozeHtIqUUP9uCqJtee6RCLzCX5x9TyGHdzJ119IWBNvoCnjszfy5xce
RA7tWiHLVADjYn2qP4Z+ygu3LO6YUhREiXSz0d2XeN2QkRVpjgtaQaRbMXjYVB3I
Vl9qiCVv3s54N4hE3aTetlztwtfl6KiPowzGDXAimIkuMBWvfAJpxqMpvr/dCKkC
SOsCAwEAAaOCAXMwggFvMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMG
CWCGSAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNh
dGUwHQYDVR0OBBYEFFXkNlktvmRpS86rRcXBeAKTaTtqMIG5BgNVHSMEgbEwga6A
FGI2DKBocboYIepbP4Scj1qXI4TYoYGRpIGOMIGLMQswCQYDVQQGEwJDTDETMBEG
A1UECAwKVmFscGFyYWlzbzESMBAGA1UEBwwJSGFuZ2EgUm9hMRYwFAYDVQQKDA1I
ZXJldmVyaSBCbG9nMRYwFAYDVQQDDA1IZXJldmVyaSBCbG9nMSMwIQYJKoZIhvcN
AQkBFhRjb250YWN0b0BoZXJldmVyaS5jbIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATAN
BgkqhkiG9w0BAQsFAAOCAgEARea21L8UrkpR93tksQEeo8NN6pTIbd/SFWL1BBfy
t3IwmM6/mhFjMNGQ7hr7uG5N8c/JsJ9TGWq0pYZIgGe8WQNLC3PZaru8Nby4lu7i
rYPOQgtAkZ1JiAHjGATTvnunkMT6xfIPj0DEZJ3p8J9ILt6oq0ZUVuj2fljJiZ/P
P0s/LLi6qnTHP+DTJaqsqGVLotCvbGclf5AJD+ru0mKrAH7HCRm2zTI/R5dKiQaQ
zEV6zQDvSsVsCWOAupKVGvzeqJkNdMYsH04vebrSX2jWlJyr/qP4a4CCjVqyVe8H
vr9C7811Bqa713ewspEEorc8KnAbdE6X3/x+OoxSX9r4tnY2Yz81U05ifCrYJFGh
TrBZDZtthm0o+dUsL+mgey02qZ1gEvry2+mfRllzE2n7/yP8fP6or3cI3T9zsXhS
KN8k9XapnuDKsflHrwg9NhjCvKkLjErCMot6m4EB+P0od4xllRi5hztKUrwMxuN9
Sjwgvemxjf4w9FYEmOFTLQUD77BPi7Kgas+UtV76a0J2x/vrpS+lTy5ds4OqsmMs
WcEk/aH3R4dtQbuPA4m+GVw1poiZMMLCu4rsbu8Yz+nvABeKgZcym4SxgKsZYepn
EXunpihZ9+2ocn6y550LMasJsgvtNgoqh5xfeRknqEfHF0SMQIheBRAyrluIg2TX
uaI=
-----END CERTIFICATE-----
subject=/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=localhost/[email protected]
issuer=/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog Intermediate/[email protected]
---
No client certificate CA names sent
---
SSL handshake has read 5390 bytes and written 533 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
ALPN protocol: http/1.1
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 13230CAD937A6B82AE34F5E6730E6BFF154ECA2E391BB36D8F589BCDD36C1749
Session-ID-ctx:
Master-Key: A801C895B29E56182A97A6ADC4C6A798CA4B94F2BAA1A25D71D4669C4B4D58175D6C5A840C74 AFDCFE15237CD62CE7CF
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 05 b3 94 9b 42 7d 90 6c-47 32 d7 8a fb 56 f2 41 ....B}.lG2...V.A
0010 - e0 b5 4a b4 5b 7c 21 cc-ec b9 11 a1 04 27 d7 2d ..J.[|!......'.-
0020 - 3d 23 0b f8 4a 75 dc 5c-bb b0 c3 0c c4 3b 2e 4b =#..Ju.\.....;.K
0030 - 02 4f 89 1a 6d bf ec ca-e2 d1 a3 7c 47 36 70 54 .O..m......|G6pT
0040 - 2e ca eb d7 c9 26 76 c6-1f a9 d0 07 33 ae 99 ca .....&v.....3...
0050 - 27 f5 cc e3 56 0a 1c 27-66 5c a4 0f a8 f4 8a 07 '...V..'f\......
0060 - c0 3b 68 28 37 cf a0 48-38 41 7c 47 f2 fb af 13 .;h(7..H8A|G....
0070 - 40 d8 9e 8e 1f dc 6d 90-9f c3 af d7 7d 40 00 ce @.....m.....}@..
0080 - cb 79 a4 66 cf 92 37 af-3b 75 aa 16 5f 63 4f 9c .y.f..7.;u.._cO.
0090 - 74 d2 a9 36 5f 04 4f a6-a7 b8 3c d3 ae 97 88 16 t..6_.O...<.....
00a0 - 2d 9e aa e7 60 24 52 43-4b ce 9a 2d 0c 19 49 8f -...`$RCK..-..I.
00b0 - 2f 26 31 da cf 08 a4 d7-f7 23 4f 83 94 82 67 d6 /&1......#O...g.
Start Time: 1507777559
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
一些核心:调试行:
protocol.c(2220): [client ::1:52046] AH03155: select protocol from h2,http/1.1, choices=h2,http/1.1 for server localhost
protocol.c(2264): [client ::1:52046] AH03156: select protocol, proposals=http/1.1 preferences=h2,http/1.1 configured=h2,http/1.1
protocol.c(2284): [client ::1:52046] AH03157: selected protocol=http/1.1
任何提示?提前致谢!
简短回答: 我认为你需要LibreSSL 2.5或以上版本。
较长的答案:
看你的调试行:
protocol.c(2220): [client ::1:52046] AH03155: select protocol from h2,http/1.1, choices=h2,http/1.1 for server localhost
这意味着你的服务器提供h2,http/1.1
(其中第一个)和您的客户端可以从它知道的协议选择(第二个h2,http/1.1
)。所以这一切都看起来很好。
protocol.c(2264): [client ::1:52046] AH03156: select protocol, proposals=http/1.1 preferences=h2,http/1.1 configured=h2,http/1.1
这很有趣。在这个调试行中,客户端的协议列表被剥离了所有未知的协议 - 直到服务器支持的协议。
所以客户名单从h2,http/1.1
下降到只有http/1.1
。但服务器确实支持h2 - 那么为什么要删除它?我猜这是因为TLS库(LibreSSL)对H2没有任何了解。
我通过向客户端和服务器添加随机协议(H3,H4)来测试它,并且发现即使它们都支持它也会被剥离。
现在的how to h2 in apache页面确实需要ALPN,因此适用于“LibreSSL 2.1.3及更高版本”。而LibreSSL changelog并说:
2.1.3 - 安全更新和操作系统的支持改进
- 添加的应用层协议谈判(ALPN)的支持。
但是它也说:
2.5。0 - 新的API,错误修复和改进
- libtls现在支持ALPN和SNI
后来我发现this issue这表明ALPN开始(也许在2.1.3?),但尚未完成直到2016年8月之后 - 在2.5.0发布之前。
我没有做编译Apache与LibreSSL的两个版本,以确认,但总得留下点什么给你做;-)
* OpenSSL 1.1.1-dev *失败。 '/ usr/local/bin/openssl s_client -connect localhost:443 -servername localhost -alpn spdy/2,h2,h2-14 -cipher“ECDHE-RSA-AES256-GCM-SHA384”| grep ALPN'。我尝试LibreSSL,只需要建立一些依赖关系。 – nhereveri
您需要使用OpenSSL 1.0.2或更高版本或LibreSSL 2.5或更高版本来重建Apache。从我看来,你刚刚使用openssl 1.1.1作为客户端,但问题是Apache编译的LibreSSL版本。 –
感谢您澄清。我想到这仅仅是为了生成证书而使用的openssl。 – nhereveri
看起来不错,从Apache侧的最后阶段。你有没有尝试从浏览器而不是Curl连接来确认服务器问题还是你的curl设置? –
是的,我愿意。我在Chrome,Canary,Firefox和Safari中获得了相同的协议http/1.1。 – nhereveri
很奇怪。 Apache错误日志中的任何内容? –