尽管“升级"功能不会将浏览器升级到h2(HTTP/2).标头已发送 [英] Browser won't upgrade to h2 (HTTP/2) although "Upgrade" headers are sent
问题描述
我正在尝试使h2(HTTP/2)在我的Web服务器上工作.通过"ondrej"安装Apache 2.4.20.资料库.我在Debian 8和Ubuntu 14.04服务器上进行了测试,但是仍然遇到相同的问题.我正在运行OpenSSL 1.0.2和SSL虚拟主机.
I'm trying to get h2 (HTTP/2) to work on my webserver. Installed Apache 2.4.20 via the "ondrej" repository. I tested on a Debian 8 and Ubuntu 14.04 server, but I keep running into the same problems. I have OpenSSL 1.0.2 and SSL vhosts running.
奇怪的是,发送了升级头(连接:升级和升级:h2).当我进行一些外部服务器测试时,得到的响应是h2在ALPN支持下运行正常.但是问题是我测试过的浏览器(Win7上的Chrome和FireFox)无法升级到h2.
The strange thing is that the upgrade headers (Connection: upgrade and Upgrade: h2) are sent. When I do some external server testing I get the responses that h2 is running properly with ALPN support. But the problem is the browsers I tested on (Chrome and FireFox on Win7) won't upgrade to h2.
我注意到缺少的一件事是HTTP/2-Settings标头,但我在任何Apache文档中都找不到实现该标头或强制Apache发送此标头的东西.
One thing which I noticed which is missing is the HTTP/2-Settings header, but I can't find anything in any Apache documentation to implement this or force Apache to send this header.
可悲的是,我无法使用cUrl进行测试,因为我可以访问的服务器不支持任何支持HTTP/2的版本.
Sadly I couldn't test with cUrl, since the servers I have access to don't support any version which has HTTP/2 support.
我的SSL虚拟主机设置:
My SSL vhost settings:
Protocols h2 http/1.1
SSLEngine On
SSLCACertificateFile xxxxxxxx
SSLProtocol all -SSLv2 -SSLv3
SSLCompression Off
SSLHonorCipherOrder On
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RSA+AES RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4 !AES128"
Header always set Strict-Transport-Security "max-age=15552000;includeSubDomains"
SSLCertificateFile xxxxxxxx
SSLCertificateKeyFile xxxxxxxx
我正在使用prefork模块而不是使用worker运行Apache.
I'm running Apache with the prefork module instead of with workers.
谁能告诉我怎么了?
推荐答案
最后,我开始使用它了.只需将"SSLChiperSuite"更改为以下字符串即可:
In the end I got it to work. It was a matter of changing the "SSLChiperSuite" to this string:
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSADS-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-A $
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-A$
旧的-可以这么说-阻止了http2的选项.我的SSL测试等级仍然是A +.
The old one had - so to speak - an option which blocked http2. My SSL test rating is still A+ btw.
这篇关于尽管“升级"功能不会将浏览器升级到h2(HTTP/2).标头已发送的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!