Question

我的apache配置存在问题。服务器不响应HTTP / 2：

$ curl -v --http2 https://localhost/
  Trying ::1...
TCP_NODELAY set
Connected to localhost (::1) port 443 (#0)
ALPN, offering h2
ALPN, offering http/1.1
Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
successfully set certificate verify locations:
  CAfile: /etc/ssl/cert.pem
CApath: none
TLSv1.2 (OUT), TLS handshake, Client hello (1):
TLSv1.2 (IN), TLS handshake, Server hello (2):
TLSv1.2 (IN), TLS handshake, Certificate (11):
TLSv1.2 (IN), TLS handshake, Server key exchange (12):
TLSv1.2 (IN), TLS handshake, Server finished (14):
TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
TLSv1.2 (OUT), TLS change cipher, Client hello (1):
TLSv1.2 (OUT), TLS handshake, Finished (20):
TLSv1.2 (IN), TLS change cipher, Client hello (1):
TLSv1.2 (IN), TLS handshake, Finished (20):
SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
ALPN, server accepted to use http/1.1
Server certificate:
 subject: C=CL; ST=Valparaiso; L=Hanga Roa; O=Hereveri Blog; CN=localhost; emailAddress=contacto@hereveri.cl
 start date: Oct 10 17:51:15 2017 GMT
 expire date: Oct 20 17:51:15 2018 GMT
 subjectAltName: host "localhost" matched cert's "localhost"
 issuer: C=CL; ST=Valparaiso; O=Hereveri Blog; CN=Hereveri Blog Intermediate; emailAddress=contacto@hereveri.cl
 SSL certificate verify ok.
GET / HTTP/1.1
Host: localhost
User-Agent: curl/7.54.0
Accept: */*

HTTP/1.1 200 OK
Date: Wed, 11 Oct 2017 04:44:05 GMT
Server: Apache/2.4.27 (Unix) LibreSSL/2.2.7 PHP/7.1.7
Strict-Transport-Security: max-age=15768000
Upgrade: h2
Connection: Upgrade
Last-Modified: Wed, 11 Oct 2017 03:52:53 GMT
ETag: "72-55b3d5bb0cf40"
Accept-Ranges: bytes
Content-Length: 114
Vary: Accept-Encoding
Content-Type: text/html

我使用 openssl 的LibreSSL 2.2.7版本为MacOS High Sierra提供的服务器生成证书和Apache/2.4.27。

虚拟主机配置：

Listen 443 https

<VirtualHost *:443>
  ProtocolsHonorOrder On
  Protocols h2 http/1.1
  H2Direct on
  ServerAdmin contacto@hereveri.cl
  DocumentRoot "/Users/nelson/localhost"
  ServerName localhost
  ErrorLog "/Users/nelson/logs/localhost-secure-error_log"
  CustomLog "/Users/nelson/logs/localhost-secure-access_log" common
  SSLEngine on
  SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
  SSLProtocol All -SSLv2 -SSLv3
  SSLCertificateFile /etc/apache2/ssl/localhost.crt
  SSLCertificateKeyFile /etc/apache2/ssl/localhost.key
  SSLCertificateChainFile /etc/apache2/ssl/ca-chain.crt
  Header always set Strict-Transport-Security "max-age=15768000"
</VirtualHost>

我针对TLS 1.2 Cipher Suite Black List检查SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384。

使用该密码测试openssl。

$ openssl s_client -connect localhost:443 -alpn 'h2'
CONNECTED(00000005)
depth=2 C = CL, ST = Valparaiso, L = Hanga Roa, O = Hereveri Blog, CN = Hereveri Blog,  emailAddress = contacto@hereveri.cl
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri     Blog/CN=localhost/emailAddress=contacto@hereveri.cl
   i:/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog   Intermediate/emailAddress=contacto@hereveri.cl
 1 s:/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog   Intermediate/emailAddress=contacto@hereveri.cl
   i:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri    Blog/emailAddress=contacto@hereveri.cl
 2 s:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri    Blog/emailAddress=contacto@hereveri.cl
   i:/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri Blog/CN=Hereveri    Blog/emailAddress=contacto@hereveri.cl
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF/jCCA+agAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYQxCzAJBgNVBAYTAkNM
MRMwEQYDVQQIDApWYWxwYXJhaXNvMRYwFAYDVQQKDA1IZXJldmVyaSBCbG9nMSMw
IQYDVQQDDBpIZXJldmVyaSBCbG9nIEludGVybWVkaWF0ZTEjMCEGCSqGSIb3DQEJ
ARYUY29udGFjdG9AaGVyZXZlcmkuY2wwHhcNMTcxMDEwMTc1MTE1WhcNMTgxMDIw
MTc1MTE1WjCBhzELMAkGA1UEBhMCQ0wxEzARBgNVBAgMClZhbHBhcmFpc28xEjAQ
BgNVBAcMCUhhbmdhIFJvYTEWMBQGA1UECgwNSGVyZXZlcmkgQmxvZzESMBAGA1UE
AwwJbG9jYWxob3N0MSMwIQYJKoZIhvcNAQkBFhRjb250YWN0b0BoZXJldmVyaS5j
bDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMspMwmK2uXAagMr8Ehk
MlbT65xsYGDMtMeKS7tHeREqyxDT4eFYhPxpaysZiYi8qVTV+UOXUIYMOVPSTOt5
Pi3xZHEDI5ksQeN4SHEUORsC/TrdOzGnuok9xqRinetbw3lVCiIHT8J1YPuK1eqs
IJkBfxxGsozeHtIqUUP9uCqJtee6RCLzCX5x9TyGHdzJ119IWBNvoCnjszfy5xce
RA7tWiHLVADjYn2qP4Z+ygu3LO6YUhREiXSz0d2XeN2QkRVpjgtaQaRbMXjYVB3I
Vl9qiCVv3s54N4hE3aTetlztwtfl6KiPowzGDXAimIkuMBWvfAJpxqMpvr/dCKkC
SOsCAwEAAaOCAXMwggFvMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMG
CWCGSAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNh
dGUwHQYDVR0OBBYEFFXkNlktvmRpS86rRcXBeAKTaTtqMIG5BgNVHSMEgbEwga6A
FGI2DKBocboYIepbP4Scj1qXI4TYoYGRpIGOMIGLMQswCQYDVQQGEwJDTDETMBEG
A1UECAwKVmFscGFyYWlzbzESMBAGA1UEBwwJSGFuZ2EgUm9hMRYwFAYDVQQKDA1I
ZXJldmVyaSBCbG9nMRYwFAYDVQQDDA1IZXJldmVyaSBCbG9nMSMwIQYJKoZIhvcN
AQkBFhRjb250YWN0b0BoZXJldmVyaS5jbIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATAN
BgkqhkiG9w0BAQsFAAOCAgEARea21L8UrkpR93tksQEeo8NN6pTIbd/SFWL1BBfy
t3IwmM6/mhFjMNGQ7hr7uG5N8c/JsJ9TGWq0pYZIgGe8WQNLC3PZaru8Nby4lu7i
rYPOQgtAkZ1JiAHjGATTvnunkMT6xfIPj0DEZJ3p8J9ILt6oq0ZUVuj2fljJiZ/P
P0s/LLi6qnTHP+DTJaqsqGVLotCvbGclf5AJD+ru0mKrAH7HCRm2zTI/R5dKiQaQ
zEV6zQDvSsVsCWOAupKVGvzeqJkNdMYsH04vebrSX2jWlJyr/qP4a4CCjVqyVe8H
vr9C7811Bqa713ewspEEorc8KnAbdE6X3/x+OoxSX9r4tnY2Yz81U05ifCrYJFGh
TrBZDZtthm0o+dUsL+mgey02qZ1gEvry2+mfRllzE2n7/yP8fP6or3cI3T9zsXhS
KN8k9XapnuDKsflHrwg9NhjCvKkLjErCMot6m4EB+P0od4xllRi5hztKUrwMxuN9
Sjwgvemxjf4w9FYEmOFTLQUD77BPi7Kgas+UtV76a0J2x/vrpS+lTy5ds4OqsmMs
WcEk/aH3R4dtQbuPA4m+GVw1poiZMMLCu4rsbu8Yz+nvABeKgZcym4SxgKsZYepn
EXunpihZ9+2ocn6y550LMasJsgvtNgoqh5xfeRknqEfHF0SMQIheBRAyrluIg2TX
uaI=
-----END CERTIFICATE-----
subject=/C=CL/ST=Valparaiso/L=Hanga Roa/O=Hereveri  Blog/CN=localhost/emailAddress=contacto@hereveri.cl
issuer=/C=CL/ST=Valparaiso/O=Hereveri Blog/CN=Hereveri Blog     Intermediate/emailAddress=contacto@hereveri.cl
---
No client certificate CA names sent
---
SSL handshake has read 5390 bytes and written 533 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
ALPN protocol: http/1.1
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 13230CAD937A6B82AE34F5E6730E6BFF154ECA2E391BB36D8F589BCDD36C1749
    Session-ID-ctx: 
    Master-Key: A801C895B29E56182A97A6ADC4C6A798CA4B94F2BAA1A25D71D4669C4B4D58175D6C5A840C74    AFDCFE15237CD62CE7CF
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 05 b3 94 9b 42 7d 90 6c-47 32 d7 8a fb 56 f2 41   ....B}.lG2...V.A
    0010 - e0 b5 4a b4 5b 7c 21 cc-ec b9 11 a1 04 27 d7 2d   ..J.[|!......'.-
    0020 - 3d 23 0b f8 4a 75 dc 5c-bb b0 c3 0c c4 3b 2e 4b   =#..Ju.\.....;.K
    0030 - 02 4f 89 1a 6d bf ec ca-e2 d1 a3 7c 47 36 70 54   .O..m......|G6pT
    0040 - 2e ca eb d7 c9 26 76 c6-1f a9 d0 07 33 ae 99 ca   .....&v.....3...
    0050 - 27 f5 cc e3 56 0a 1c 27-66 5c a4 0f a8 f4 8a 07   '...V..'f\......
    0060 - c0 3b 68 28 37 cf a0 48-38 41 7c 47 f2 fb af 13   .;h(7..H8A|G....
    0070 - 40 d8 9e 8e 1f dc 6d 90-9f c3 af d7 7d 40 00 ce   @.....m.....}@..
    0080 - cb 79 a4 66 cf 92 37 af-3b 75 aa 16 5f 63 4f 9c   .y.f..7.;u.._cO.
    0090 - 74 d2 a9 36 5f 04 4f a6-a7 b8 3c d3 ae 97 88 16   t..6_.O...<.....
    00a0 - 2d 9e aa e7 60 24 52 43-4b ce 9a 2d 0c 19 49 8f   -...`$RCK..-..I.
    00b0 - 2f 26 31 da cf 08 a4 d7-f7 23 4f 83 94 82 67 d6   /&1......#O...g.

    Start Time: 1507777559
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

一些核心：调试行：

protocol.c(2220): [client ::1:52046] AH03155: select protocol from h2,http/1.1, choices=h2,http/1.1 for server localhost
protocol.c(2264): [client ::1:52046] AH03156: select protocol, proposals=http/1.1 preferences=h2,http/1.1 configured=h2,http/1.1
protocol.c(2284): [client ::1:52046] AH03157: selected protocol=http/1.1

任何提示？提前谢谢！

Answer 1

简答： 我认为您需要LibreSSL 2.5或更高版本。

更长的回答：

查看调试行：

protocol.c(2220): [client ::1:52046] AH03155: select protocol from h2,http/1.1, choices=h2,http/1.1 for server localhost

这意味着您的服务器正在提供h2,http/1.1（其中第一个），您的客户端可以从它所知道的协议中选择（第二个h2,http/1.1）。所以在这一点上看起来都很好。

protocol.c(2264): [client ::1:52046] AH03156: select protocol, proposals=http/1.1 preferences=h2,http/1.1 configured=h2,http/1.1

这很有趣。在此调试行中，客户端的协议列表将被删除所有未知协议 - 直至服务器支持的协议。

因此，客户列表从h2,http/1.1变为http/1.1。但服务器显然支持h2 - 那么为什么它会消除它？我猜这是因为TLS库（LibreSSL）对H2没有任何了解。

我通过向客户端和服务器添加随机协议（H3，H4）来测试它，并看到它被剥离，即使它们都支持它。

现在how to h2 in apache页面确实说它需要ALPN，因此可以使用“LibreSSL 2.1.3及以后版本”。而LibreSSL changelog确实说：

2.1.3 - 安全更新和操作系统支持改进


添加了应用层协议协商（ALPN）支持。

然而它也说：

2.5.0 - 新的API，错误修复和改进


libtls现在支持ALPN和SNI

然后我发现this issue表明ALPN已启动（可能在2.1.3？）但直到2016年8月之后才完成 - 就在2.5.0发布之前。

我没有用LibreSSL的两个版本构建Apache的最后阶段来确认，但是要留下让你做的事情; - ）

Answer 2

Apache缺少HTTP / 2支持的另一个原因是，自版本2.4.27开始，Apache MPM（多处理模块）prefork不再支持HTTP / 2-因此您需要使用另一种MPM模式，例如worker或event。对于每次尝试的H2连接，您都会在错误日志中看到此消息：

AH10034：mod_http2不支持mpm模块（prefork.c）。的 mpm决定如何处理服务器中的内容。 HTTP / 2有在这方面的更多需求，当前选择的mpm只会不做。这是一个警告性警告。您的服务器将继续可以，但是HTTP / 2协议将无效。

Apache基金会有一个HTTP/2 guide，其中还提到，即使在Apache停止以prefork模式支持H2之前，当人们尝试将H2与prefork模式一起使用时，也会受到严格的限制。另外请注意，如果您使用的是lib_php，则必须采用另一种方法（例如，使用fastCGI），因为只有前叉模式才支持。

在apache 2中启用HTTP / 2

2 个答案: