mod_http3 0.0.52 for Apache httpd 2.4.68 is available for testing

Experimental mod_http3 0.0.52 packages are now available in the CodeIT testing repository for EL7, EL8, EL9 and EL10.

The module requires our patched httpd 2.4.68-2 package, which includes MPM changes required for externally managed QUIC connections.

HTTP/3 support remains experimental. Use these packages on testing systems before considering production deployment.

Installation

For EL8, EL9 and EL10:

dnf module reset -y httpd
dnf module enable -y httpd:codeit
dnf config-manager --setopt=CodeIT-testing.module_hotfixes=1 --save

dnf --enablerepo=CodeIT-testing install -y \
    httpd mod_ssl mod_http2 mod_http3

For EL7:

yum --enablerepo=CodeIT-testing install -y \
    httpd mod_ssl mod_http2 mod_http3

Verify the installed versions:

rpm -q httpd mod_http3

Expected versions:

httpd-2.4.68-2...
mod_http3-0.0.52-1...

Configuration

Default example configuration file is /etc/httpd/vhosts.d/http3-vhost.conf (installed together with the package):

EnableMMAP Off

# Keep the existing Listen directive.
# Do not duplicate it if another configuration file already contains it:
# Listen 443 https

<VirtualHost *:443>
    ServerName example.com

    SSLEngine on
    SSLCertificateFile    /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

    Protocols h3 h2 http/1.1

    H3Port 443
    H3QuicEngine openssl
    H3CertificatePath    /etc/pki/tls/certs/localhost.crt
    H3CertificateKeyPath /etc/pki/tls/private/localhost.key

    DocumentRoot /var/www/html

    <Directory /var/www/html>
        Require all granted
    </Directory>
</VirtualHost>

Check the configuration and restart Apache:

httpd -t
httpd -M | grep -E 'http3|http2|ssl'
systemctl restart httpd

Firewall

HTTP/3 uses QUIC over UDP. Both TCP and UDP port 443 must be open:

firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=443/udp
firewall-cmd --reload

Check the listeners:

ss -lntup | grep ':443'

Testing HTTP/3

The CodeIT ngtcp2 package includes the osslclient QUIC test client. To test the local Apache instance while sending example.com as the target hostname, run:

dnf install ngtcp2

osslclient 127.0.0.1 443 https://example.com

This connects directly to UDP port 443 on localhost and performs an HTTP/3 request using example.com for TLS and HTTP hostname handling.

You can also use a curl build that lists HTTP3 in curl -V:

curl --http3-only -vkI https://example.com/

A successful response should contain:

HTTP/3 200

You can also test graceful restart behavior while an HTTP/3 connection is active:

apachectl graceful
journalctl -u httpd -f

The first browser request may use HTTP/2 while the browser discovers HTTP/3 through Alt-Svc. Reload the page and check the Protocol column in browser Developer Tools for h3.

Please report successful installations, crashes, compatibility issues and graceful-restart problems through comments.