Chapter 6. Enabling HTTP/2 for the JBCS Apache HTTP Server The Hypertext Transfer Protocols (HTTP) are standard methods of transmitting data between applications, such as servers and browsers, over the internet. The Apache HTTP Server supports the use of HTTP/2 for encrypted connections that are using Transport Layer Security (TLS), which is indicated by the h2 keyword when enabled. HTTP/2 improves on HTTP/1.1 by providing the following enhancements: Header compression omits implied information to reduce the size of the header that is transmitted. Multiple requests and responses over a single connection use binary framing rather than textual framing to break down response messages. Note The Apache HTTP Server does not support the use of HTTP/2 for unencrypted connections that are using the Transmission Control Protocol (TCP), which is indicated by the h2c keyword when enabled. HTTP/2 is not available for web servers that are using the Multi-Processing Module (MPM) pre-fork ( modules/mod_mpm_prefork.so ). 6.1. Prerequisites You have root user access on Red Hat Enterprise Linux. You have administrative access on Windows Server. You have installed Red Hat JBoss Core Services Apache HTTP Server 2.4.23 or later. You have installed the SSL module ( modules/mod_ssl.so ). If you need to install the SSL module, enter the following command: You have installed the HTTP/2 module ( modules/mod_http2.so ). If you need to install the HTTP/2 module, enter the following command: Note Red Hat Enterprise Linux 6 is no longer supported and subsequently was removed from the documentation. 6.2. Enabling HTTP/2 for the Apache HTTP Server You can enable HTTP/2 for the Apache HTTP Server by updating configuration file settings in the HTTP_HOME directory. Procedure To add the http2_module to the configuration: Open the HTTP_HOME /conf.modules.d/00-base.conf file. Enter the following line: To add the h2 protocol to the configuration: Open the HTTP_HOME /conf/httpd.conf file. If you want to enable HTTP/2 support for a virtual host, add the h2 protocol to the virtual host configuration. Alternatively, if you want to enable HTTP/2 support for all server connections, add the h2 protocol to the main server configuration section. For example: <IfModule http2_module> Protocols h2 http/1.1 ProtocolsHonorOrder on </IfModule> To update the Secure Socket Layer (SSL) configuration: Open the HTTP_HOME /conf.d/ssl.conf file: Ensure the SSLEngine directive is set to enabled. The SSL Engine is enabled by default. Update the SSLProtocol directive to disable the SSLv2 and SSLv3 protocols. This forces connections to use the Transport Layer Security (TLS) Protocols. Update the SSLCipherSuite directive to specify which SSL ciphers can be used with the Apache HTTP Server. For example: Note For more information about the SSL module and the supported directives, see Apache HTTP Server Documentation Version 2.4 - Modules: Apache Module mod_ssl . To restart the Red Hat JBoss Core Services Apache HTTP Server, and apply the changed configuration, perform one of the following steps as the root user: If you want to use systemd to start the Apache HTTP Server on Red Hat Enterprise Linux, enter the following command: If you want to use apachectl to start Red Hat JBoss Core Services on Red Hat Enterprise Linux, enter the following command: If you want to start the Apache HTTP Server on Windows Server, enter the following command: Additional resources For more information about the HTTP/2 module and the supported directives, see Apache HTTP Server Documentation Version 2.4 - Modules: Apache Module mod_http2 . For more information about the SSL module and the supported directives, see Apache HTTP Server Documentation Version 2.4 - Modules: Apache Module mod_ssl . 6.3. Viewing Apache HTTP Server logs to verify that HTTP/2 is enabled You can view the Apache HTTP Server access log or request log to verify that HTTP/2 is enabled. Prerequisites You have enabled HTTP/2 . Procedure Access the server from a browser or by using the curl command-line tool. To check the SSL/TLS request log, enter the following command: To check the SSL/TLS access log, enter the following command: Verification If HTTP/2 is enabled, the grep 'HTTP/2' HTTP_HOME /logs/ssl_request_log command produces the following type of output: If HTTP/2 is enabled, the grep 'HTTP/2' HTTP_HOME /logs/ssl_access_log command produces the following type of output: 6.4. Using the curl command to verify that HTTP/2 is enabled You can use the curl command-line tool to verify that HTTP/2 is enabled. Note The curl package that is provided with Red Hat Enterprise Linux 7 or earlier does not support HTTP/2. Prerequisites You have enabled HTTP/2 . You are using a version of curl that supports HTTP2 . To check that you are using a version of curl that supports HTTP/2, enter the following command: This command produces the following type of output: Procedure To check that the HTTP/2 protocol is active, enter the following command: Note In the preceding example, replace <JBCS_httpd_server> with the URI of the server, such as example.com , and replace <test.html> with any HTML file that you want to use to test the configuration. An example HTML test page is not provided. The port number is dependent on your configuration. Verification If the HTTP/2 protocol is active, the curl command produces the following output: Otherwise, if the HTTP/2 protocol is inactive, the curl command produces the following output: 6.5. Additional resources (or steps) For more information about using HTTP/2, see Apache HTTP Server Documentation Version 2.4 - How-To / Tutorials: HTTP/2 guide . For information about SSL configuration, see Apache HTTP Server Documentation Version 2.4 - SSL/TLS Strong Encryption: How-To . For more information about the proposed internet standard for HTTP/2, see IETF: RFC 7540 - Hypertext Transfer Protocol Version 2 (HTTP/2) .

Commands:
install mod_ssl
install mod_http2
LoadModule http2_module modules/mod_http2.so
<IfModule http2_module> Protocols h2 http/1.1 ProtocolsHonorOrder on </IfModule>
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
systemctl restart jbcs-httpd24-httpd.service
HTTP_HOME /sbin/apachectl restart
net restart Apache2.4
grep 'HTTP/2' HTTP_HOME /logs/ssl_request_log
grep 'HTTP/2' HTTP_HOME /logs/ssl_access_log
[26/Apr/2018:06:44:45 +0000] 172.17.0.1 TLSv1.2 AES128-SHA "HEAD /html-single/index.html HTTP/2 " -
172.17.0.1 - - [26/Apr/2018:06:44:45 +0000] "HEAD /html-single/index.html HTTP/2 " 200 -
curl -V
curl 7.55.1 (x86_64-redhat-linux-gnu) Release-Date: 2017-08-14 Protocols: dict file ftp ftps gopher http https Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy Metalink PSL
curl -I https:// <JBCS_httpd_server> : <port> / <test.html>
HTTP/2 200
HTTP/1.1 200