How To Set Up Nginx with HTTP/2 Support
Tags: nginx, devops, http2, http
Published: 2018-06-20 10:26:31

---
title: How To Set Up Nginx with HTTP/2 Support
published: true
description: One of the protocols supported is the relatively new HTTP/2, which was published in May 2015. The main advantage of HTTP/2 is its high transfer speed for content-rich websites.
tags: nginx, devops, http2, http
cover_image: https://cdn-images-1.medium.com/max/1600/1*r8pcK3GS9OQPEaO37MC0OQ.jpeg
---

NGINX is a fast and reliable open-source web server. It gained its popularity due to its low memory footprint, high scalability, ease of configuration, and support for the vast majority of different protocols.

One of the protocols supported is the relatively new HTTP/2, which was published in May 2015. The main advantage of HTTP/2 is its high transfer speed for content-rich websites.

#### Prerequisites

Before we get started, we will need a few things:

* Ubuntu 18.04 (or 16.04/14.04)
* An SSL certificate. Generate a self-signed certificate, obtain a free one from Let's Encrypt, or buy one from another provider.
* That is all. If you have everything listed above, you are ready to go.

#### Step 1 — Installing the Latest Version of Nginx

Support of the `HTTP/2` protocol was introduced in `Nginx 1.9.5`. Fortunately, the default repository in Ubuntu 16.04 contains a version higher than this, so we don't have to add a third party repository.

First, update the list of available packages in the apt packaging system:

    sudo apt-get update
Then, install Nginx:

    sudo apt-get install nginx
After the installation process finishes, you can check the version of Nginx by typing:

    sudo nginx -v

The output should be similar to the following:

    nginx version: nginx/1.14.0 (Ubuntu)

#### Step 2 — Changing the Listening Port and Enabling HTTP/2

The first change we will make will be to change the listening port from `80` to `443`.

Let's open the configuration file:

    sudo nano /etc/nginx/sites-available/default

By default, Nginx is set to listen to port `80`, which is the standard `HTTP` port:
    
    listen 80; 
    listen [::]:80;

As you can see, we have two different listen variables. The first one is for all `IPv4`connections. The second one is for `IPv6` connections. We will enable encryption for both.

Modify the listening port to `443`, which is used by the HTTPS protocol:
    
    listen 443 ssl http2; 
    listen [::]:443 ssl http2;

Notice that in addition to ssl, we also added http2 to the line. This variable tells Nginx to use HTTP/2 with supported browsers.

#### Step 3 — Changing the Server Name

We use the `server_name` entry to specify which domain should be associated with the configuration file. Locate the `server_name` entry in the configuration file.

By default, server_name is set to `_` (underscore), which means the config file is responsible for all incoming requests. Change `_` to your actual domain, like this:
    
    server_name example.com;

Save the configuration file and edit the text editor.

Whenever you make changes to Nginx configuration files, you should check the configuration for syntax errors, like this:
    
    sudo nginx -t

If the syntax is error-free, you will see the following output:
    
    nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful

#### Step 4 — Adding the SSL Certificates

Next, you need to configure Nginx to use your `SSL` certificate. If you don't know what an `SSL` certificate is or currently don't have any, please follow this [tutorial][2].

Create a directory to store your `SSL` certificates inside the Nginx configuration directory:
    
    sudo mkdir /etc/nginx/ssl

Copy your certificate and the private key to this location. We will also rename the files to show which domain they are associated. This will come in handy in the future, when you have more than one domain associated with this server. Replace example.com with your actual hostname:
    
    sudo cp /path/to/your/certificate.crt /etc/nginx/ssl/example.com.crt sudo cp /path/to/your/private.key /etc/nginx/ssl/example.com.key

Now, let's open our configuration file one again and configure SSL.
    
    sudo nano /etc/nginx/sites-available/default

On new lines inside the server block, define the location of your certificates:
    
    ssl_certificate /etc/nginx/ssl/example.com.crt;   
    ssl_certificate_key /etc/nginx/ssl/example.com.key; 

Save the file, and exit the text editor.

#### Step 5 — Avoiding Old Cipher Suites

`HTTP/2` has a huge blacklist of old and insecure ciphers, so we must avoid them. Cipher suites are a bunch of cryptographic algorithms, which describe how the transferring data should be encrypted.

We will use a really popular cipher set, whose security was approved by Internet giants like CloudFlare. It does not allow the usage of MD5 encryption (which was known as insecure since 1996, but despite this fact, its use is widespread even to this day).

Open the following configuration file:
    
    sudo nano /etc/nginx/nginx.conf

Add this line after `ssl_prefer_server_ciphers on;`.
    
    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;

Save the file, and exit the text editor.

Once again, check the configuration for syntax errors:
    
    sudo nginx -t

#### Step 6 — Redirecting all HTTP Request to HTTPS

Since we are interested in serving the content through HTTPS only, we should tell Nginx what it should do if the server receives an HTTP request.

At the bottom of our file, we will create a new server block for redirecting all HTTP requests to HTTPS (be sure to replace the server name with your actual domain name):
    
    server {  
    listen         80;  
    listen    [::]:80;  
    server_name    example.com;  
    return         301 ;  
    }

Save the file, and exit the configuration file.

Check the configuration for syntax errors:
    
    sudo nginx -t

#### Step 7 — Reloading Nginx

That's it for all the Nginx configuration changes. Since we checked for syntax errors with each change, you should be ready to restart Nginx and test your changes.

To summarize, ignoring commented out lines, your configuration file should now look similar to this:
    
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name example.com;
        root /var/www/html;
        index index.html index.htm index.nginx-debian.html;
    
        location / {
            try_files $uri $uri/ =404;
        }
        ssl_certificate /etc/nginx/ssl/example.com.crt;
        ssl_certificate_key /etc/nginx/ssl/example.com.key;
        ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    }
    server {
           listen         80;
           listen    [::]:80;
           server_name    example.com;
           return         301 https://$server_name$request_uri;
    }

To apply the changes, restart the Nginx server.
    
    sudo systemctl restart nginx

### Conclusion

Your Nginx server is now serving HTTP/2 pages. If you want to test the strength of your SSL connection, please visit [Qualys SSL][3] Lab and run a test against your server. If everything is configured properly, you should get an A+ mark for security.

[1]: https://cdn-images-1.medium.com/max/1600/1*r8pcK3GS9OQPEaO37MC0OQ.jpeg
[2]: https://dev.to/grigorkh/how-to-setup-lets-encrypt-for-nginx-ipv6a-sll-rating-3j0i
[3]: https://www.ssllabs.com/ssltest/