Experimental mod_http3 0.0.53 packages are now available in the CodeIT testing repository for EL7, EL8, EL9 and EL10.
The module requires our patched httpd 2.4.68-2 package, which includes MPM changes required for externally managed QUIC connections.
HTTP/3 support remains experimental. Use these packages on testing systems before considering production deployment.
Changes
*) Rejected malformed HTTP/3 requests (missing or duplicate pseudo-header fields, connection-specific fields, content-length mismatch) with a stream error of type H3_MESSAGE_ERROR per RFC 9114 4.1.2. Previously one malformed request closed the whole QUIC connection, ending every other request in flight on it.
[Alexander Gerasimov]
*) Added support for building against httpd 2.4.52+. Without response buckets the module removes the core HTTP_HEADER filter from its requests and snapshots status and headers itself, mirroring mod_http2’s !AP_HAS_RESPONSE_BUCKETS path.
[Alexander Gerasimov]
*) Made the MPM connection-count notifications optional. Stock 2.4.x MPMs do not provide them; the module then runs in a degraded mode where a graceful child stop does not wait for active QUIC connections to drain. The patch in .patches/httpd-2.4.66-pr699.patch adds the notifications to httpd 2.4.x.
[Alexander Gerasimov]
*) Enforced H3IdleTimeout in the module’s own event loop. The QUIC stacks keep an otherwise idle connection alive by themselves — OpenSSL sends a keepalive PING at half the idle interval to hold NAT state open — which resets both endpoints’ idle timers, so the transport timeout never fired and a finished connection held its session pool and its H3MaxConnections slot until the client went away.
[Alexander Gerasimov]
*) Read queued datagrams in one batch with recvmmsg() where the platform has
it, and read the socket’s local address once per event-loop pass instead
of once per datagram, halving the syscalls the ngtcp2 engine spends on a
busy socket. The OpenSSL engine already batches inside its own datagram
BIO. Also dropped a per-pass walk of the connection list whose result was
never used.
[Alexander Gerasimov]
*) Added H3SocketBufferSize, which asks for the QUIC socket send and receive buffer size. A receive buffer left at the OS default overflows once a single connection runs at speed, and each dropped datagram costs a retransmit; the OS still caps what it grants, and a capped grant is logged rather than fatal.
[Alexander Gerasimov]
*) Added H3SessionTickets, which controls whether TLS 1.3 session tickets are issued so a returning client can resume instead of running a full handshake. Tickets stay on by default, as before, and each worker process keeps its own ticket keys, so a client resumes only when it returns to the process that issued its ticket.
[Alexander Gerasimov]
*) Added H3EarlyData, off by default, together with an engine capability bit saying whether 0-RTT can be accepted at all. The OpenSSL QUIC stack has no server-side 0-RTT, so turning early data on there now logs a warning that names the engine instead of silently doing nothing.
[Alexander Gerasimov]
*) Published the mod_ssl TLS environment for HTTP/3 requests: SSL_PROTOCOL, SSL_CIPHER, SSL_CIPHER_USEKEYSIZE, SSL_CIPHER_ALGKEYSIZE, SSL_CIPHER_EXPORT and SSL_SESSION_RESUMED, under the names mod_ssl uses. mod_ssl does not manage these connections, so scripts and rewrite conditions that read them saw nothing but HTTPS=on over HTTP/3. The values are read from the QUIC engine through a new conn.tls_info entry and formatted once per connection, not per request.
[Alexander Gerasimov]
Installation
For EL8, EL9 and EL10:
dnf module reset -y httpd
dnf module enable -y httpd:codeit
dnf config-manager --setopt=CodeIT-testing.module_hotfixes=1 --save
dnf --enablerepo=CodeIT-testing install -y \
httpd mod_ssl mod_http2 mod_http3
For EL7:
yum --enablerepo=CodeIT-testing install -y \
httpd mod_ssl mod_http2 mod_http3
Verify the installed versions:
rpm -q httpd mod_http3
Expected versions:
httpd-2.4.68-2...
mod_http3-0.0.53-1...
Configuration
Default example configuration file is /etc/httpd/vhosts.d/http3-vhost.conf (installed together with the package):
EnableMMAP Off
# Keep the existing Listen directive.
# Do not duplicate it if another configuration file already contains it:
# Listen 443 https
<VirtualHost *:443>
ServerName example.com
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
Protocols h3 h2 http/1.1
H3Port 443
H3QuicEngine openssl
H3CertificatePath /etc/pki/tls/certs/localhost.crt
H3CertificateKeyPath /etc/pki/tls/private/localhost.key
DocumentRoot /var/www/html
<Directory /var/www/html>
Require all granted
</Directory>
</VirtualHost>
Check the configuration and restart Apache:
httpd -t
httpd -M | grep -E 'http3|http2|ssl'
systemctl restart httpd
Firewall
HTTP/3 uses QUIC over UDP. Both TCP and UDP port 443 must be open:
firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=443/udp
firewall-cmd --reload
Check the listeners:
ss -lntup | grep ':443'
Testing HTTP/3
The CodeIT ngtcp2 package includes the osslclient QUIC test client. To test the local Apache instance while sending example.com as the target hostname, run:
dnf install ngtcp2
osslclient 127.0.0.1 443 https://example.com
This connects directly to UDP port 443 on localhost and performs an HTTP/3 request using example.com for TLS and HTTP hostname handling.
You can also use a curl build that lists HTTP3 in curl -V:
curl --http3-only -vkI https://example.com/
A successful response should contain:
HTTP/3 200
You can also test graceful restart behavior while an HTTP/3 connection is active:
apachectl graceful
journalctl -u httpd -f
The first browser request may use HTTP/2 while the browser discovers HTTP/3 through Alt-Svc. Reload the page and check the Protocol column in browser Developer Tools for h3.
Please report successful installations, crashes, compatibility issues and graceful-restart problems through comments.
