关于NGINX配置HTTP/2的问题

Ciel

因为使用TLS，决定升级一下H2，整了一个多点没什么头绪，访问仍然是HTTP/1.1配置文件

1. server
   
2.     {
   
3.         listen 443 ssl http2;
   
4.         listen [::]:443 ssl http2;
   
5.         ssl on;
   
6.         ssl_certificate ***;
   
7.         ssl_certificate_key ***;
   
8. ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_session_cache shared:SSL:10m;ssl_stapling on;ssl_stapling_verify on;resolver 114.114.114.114 114.114.115.115 valid=300s;resolver_timeout 10s;ssl_prefer_server_ciphers on;ssl_dhparam /etc/ssl/certs/dhparam.pem;        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
   
9.         add_header X-Frame-Options SAMEORIGIN;
   
10.         server_name ciel.pro;
    
11.         index index.html index.htm index.php default.html default.htm default.php;
    
12.         root  /home/wwwroot/ciel.pro;
    
13. 
    
14.         include wordpress.conf;
    
15.         #error_page   404   /404.html;
    
16.         location ~ [^/]\.php(/|$)
    
17.         {
    
18.                 #comment try_files $uri =404; to enable pathinfo
    
19.                 try_files $uri =404;
    
20.                 fastcgi_pass  unix:/tmp/php-cgi.sock;
    
21.                 fastcgi_index index.php;
    
22.                 include fastcgi.conf;
    
23.                 #include pathinfo.conf;
    
24.         }
    
25.         location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|woff)$
    
26.         {
    
27.                 expires      30d;
    
28.         }
    
29. 
    
30.         location ~ .*\.(js|css)?$
    
31.         {
    
32.                 expires      12h;
    
33.         }
    
34. 
    
35. location ~ /\.
    
36.         {
    
37.             deny all;
    
38.         }
    
39. 
    
40.         access_log  /home/wwwlogs/ciel.pro.log;
    
41.     }
    
42. server
    
43.     {
    
44.         listen 443 ssl http2;
    
45.         listen [::]:443 ssl http2;
    
46.         server_name www.ciel.pro;
    
47.         ssl on;
    
48.         ssl_certificate *****;
    
49.         ssl_certificate_key *****;
    
50. ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_session_cache shared:SSL:10m;ssl_stapling on;ssl_stapling_verify on;resolver 114.114.114.114 114.114.115.115 valid=300s;resolver_timeout 10s;ssl_prefer_server_ciphers on;ssl_dhparam /etc/ssl/certs/dhparam.pem;        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
    
51.         add_header X-Frame-Options SAMEORIGIN;
    
52.         return 301 https://ciel.pro$request_uri;
    
53.     }
    
54. server
    
55.     {
    
56.         listen 80;
    
57.         listen [::]:80;
    
58.         server_name ciel.pro www.ciel.pro;
    
59.         return 301 https://ciel.pro$request_uri;
    
60.     }

复制代码

不知道哪位成功配置H2的dalao能指点下？

[ 本帖最后由 Ciel 于 2016-11-7 12:44 编辑 ]

licess

在一些高版本的chrome 50或其他浏览器上是必须要求alpn才能支持到http2的，要开alpn需要是openssl 1.0.2的版本

alpn的支持需要在nginx编译时指定上 --with-openssl=openssl源码目录全路径

具体可以参考：https://bbs.vpser.net/thread-14702-1-1.html

明月登楼

其实就是OpenSSL版本不对而已！