mod_http3 0.0.54 for Apache httpd 2.4.68 is available for testing

Experimental mod_http3 0.0.54 packages are now available in the CodeIT testing repository for EL7, EL8, EL9 and EL10.

The module requires our patched httpd 2.4.68-2 package, which includes MPM changes required for externally managed QUIC connections.

HTTP/3 support remains experimental. Use these packages on testing systems before considering production deployment.

Changes

— applies the core LimitRequestFields and LimitRequestFieldSize to HTTP/3 requests, which nothing did before, and advertises the bound as SETTINGS_MAX_FIELD_SECTION_SIZE instead of nghttp3’s (1<<62)-1 — bounds a response that makes no progress (H3StreamTimeout) so a client that stops reading cannot hold a worker thread, and closes a connection past H3MaxStreamErrors — advertises a QPACK dynamic table (H3QpackTableCapacity, H3QpackBlockedStreams); it was disabled, so HTTP/3 compressed request headers worse than HTTP/2 on the same server — exposes the request worker pool (H3MinWorkers, H3MaxWorkers, H3MaxWorkerIdleSeconds), previously hardcoded at 16/64 — resolves mod_logio once instead of once per request

Installation

For EL8, EL9 and EL10:

dnf module reset -y httpd
dnf module enable -y httpd:codeit
dnf config-manager --setopt=CodeIT-testing.module_hotfixes=1 --save

dnf --enablerepo=CodeIT-testing install -y \
    httpd mod_ssl mod_http2 mod_http3

For EL7:

yum --enablerepo=CodeIT-testing install -y \
    httpd mod_ssl mod_http2 mod_http3

Verify the installed versions:

rpm -q httpd mod_http3

Expected versions:

httpd-2.4.68-2...
mod_http3-0.0.54-1...

Configuration

Default example configuration file is /etc/httpd/vhosts.d/http3-vhost.conf (installed together with the package):

EnableMMAP Off

# Keep the existing Listen directive.
# Do not duplicate it if another configuration file already contains it:
# Listen 443 https

<VirtualHost *:443>
    ServerName example.com

    SSLEngine on
    SSLCertificateFile    /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

    Protocols h3 h2 http/1.1

    H3Port 443
    H3QuicEngine openssl
    H3CertificatePath    /etc/pki/tls/certs/localhost.crt
    H3CertificateKeyPath /etc/pki/tls/private/localhost.key

    DocumentRoot /var/www/html

    <Directory /var/www/html>
        Require all granted
    </Directory>
</VirtualHost>

Check the configuration and restart Apache:

httpd -t
httpd -M | grep -E 'http3|http2|ssl'
systemctl restart httpd

Firewall

HTTP/3 uses QUIC over UDP. Both TCP and UDP port 443 must be open:

firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=443/udp
firewall-cmd --reload

Check the listeners:

ss -lntup | grep ':443'

Testing HTTP/3

The CodeIT ngtcp2 package includes the osslclient QUIC test client. To test the local Apache instance while sending example.com as the target hostname, run:

dnf install ngtcp2

osslclient 127.0.0.1 443 https://example.com

This connects directly to UDP port 443 on localhost and performs an HTTP/3 request using example.com for TLS and HTTP hostname handling.

You can also use a curl build that lists HTTP3 in curl -V:

curl --http3-only -vkI https://example.com/

A successful response should contain:

HTTP/3 200

You can also test graceful restart behavior while an HTTP/3 connection is active:

apachectl graceful
journalctl -u httpd -f

The first browser request may use HTTP/2 while the browser discovers HTTP/3 through Alt-Svc. Reload the page and check the Protocol column in browser Developer Tools for h3.

Please report successful installations, crashes, compatibility issues and graceful-restart problems through comments.