To enable HTTP/2 in Nginx, use a build that contains ngx_http_v2_module, configure a valid TLS certificate, keep TLS on listen 443 ssl;, and enable the protocol with the server-level http2 on; directive. Test the configuration, reload Nginx, then verify that clients negotiated HTTP/2 over HTTPS. The older listen 443 ssl http2; form is deprecated in newer Nginx releases.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What HTTP/2 support in Nginx actually requires
Nginx does not provide HTTP/2 merely because port 443 is open. The feature is implemented by the ngx_http_v2_module. Nginx documentation identifies the module as providing HTTP/2 support since Nginx 1.9.5, but also notes that it is not built by default. A package must include the module, or a source build must be configured with --with-http_v2_module.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For normal browser traffic, HTTP/2 is negotiated over TLS. You therefore need a hostname, a certificate whose names match that hostname, the corresponding private key, and TLS support with ALPN. Nginx documents ALPN support for the HTTP/2 TLS path as available with OpenSSL 1.0.2 and later. If any of these pieces is missing, a syntactically valid server block can still serve HTTPS while falling back to HTTP/1.1.
Check the prerequisites before editing a server block
| Requirement | What to check | Why it matters |
|---|---|---|
| Nginx version and build | The installed binary and its configure arguments | The HTTP/2 module may be absent even when Nginx itself is installed. |
| HTTP/2 module | --with-http_v2_module in the build options, or an operating-system package that includes the module |
Without ngx_http_v2_module, the http2 directive is unknown and HTTP/2 cannot be enabled. |
| TLS certificate | A certificate covering every hostname in the server block | Browsers require a valid HTTPS connection before negotiating HTTP/2. |
| Private key | The key corresponding to the certificate, readable by the Nginx master process | A wrong or inaccessible key prevents Nginx from loading the TLS server. |
| ALPN-capable TLS library | The OpenSSL version linked to Nginx | ALPN lets a client and server select HTTP/2 during the TLS handshake. |
| DNS and firewall | The hostname resolves to this server and TCP 443 is reachable | Testing another machine or virtual server can produce misleading protocol results. |
Keep the certificate chain and key paths specific to the host you are configuring. The examples below use example.com; replace it with your real names and absolute paths.
#1 Best Overall
Confirm that the installed Nginx contains HTTP/2 support
Inspect a packaged installation
Run the binary’s version command as the account that administers Nginx:
nginx -V 2>&1Review the printed configure arguments for --with-http_v2_module. The same output identifies the OpenSSL library linked into the binary on many distributions. If the argument is present, the binary was built with the module. If it is missing, do not add http2 on; yet: install a package that includes HTTP/2 or replace the binary with a source build configured for it.
Some distributions split functionality into separate packages or ship different Nginx variants. The exact package name and service command depend on the operating system, so use that system’s package documentation rather than assuming a package from another distribution will be compatible.
Enable the module in a source build
When compiling Nginx yourself, include the documented option in the configure step:
./configure --with-http_v2_module [other options]
make
sudo make installThe bracketed text represents the options required by your existing deployment; it is not a literal argument. Preserve any previously enabled modules and paths when rebuilding. After installation, run nginx -V 2>&1 against the binary that your service actually starts. It is common to compile one binary while the service manager continues invoking another path.
Do not remove the old binary or configuration until the replacement passes a configuration test. Keep a recovery path, because a compile-time change can affect modules, file locations, or service ownership even when the HTTP/2 option itself is correct.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Prepare the certificate, key and hostname
Obtain a certificate for each public hostname you will place in server_name. If one certificate contains several names, its subject alternative names must include all of them. Store the certificate chain in a file such as fullchain.pem and the matching private key in a separate file such as privkey.pem.
- Use absolute paths in
ssl_certificateandssl_certificate_key. - Make the private key readable only by the Nginx master process or the service account that must load it.
- Ensure the certificate and key are a pair. A certificate from one issuance and a key from another will fail at startup.
- Install the complete chain expected by clients, not just the leaf certificate, when your certificate authority supplies an intermediate chain.
- Plan renewal and reload procedures before putting the configuration into production. A renewed file is not necessarily used until Nginx reloads successfully.
The SSL module supplies the ssl_certificate and ssl_certificate_key directives used in the server block. The exact filesystem permissions and renewal hooks vary by operating system, but the key must remain protected throughout the process.
Redirect HTTP traffic to HTTPS
HTTP/2 browser deployment normally uses HTTPS, so provide a clear redirect for requests arriving on port 80. A minimal redirect server is:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}This server does not enable HTTP/2; it only moves clients to the TLS endpoint. Replace the names with the hostnames covered by your certificate. If you have additional aliases, either include them in the certificate and server_name or create a deliberate redirect for each one.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Configure the HTTPS virtual server with current syntax
Use the newer separation between the transport and the protocol setting:
server {
listen 443 ssl;
server_name example.com www.example.com;
http2 on;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
root /var/www/example;
index index.html;
}listen 443 ssl; binds the virtual server to the HTTPS port and enables TLS for that listener. The standalone http2 on; directive enables HTTP/2 in the server context. The certificate directives identify the chain and private key that complete the TLS handshake. The root and index lines are only an example content setup; retain the application-specific routing, proxying, access controls and logging that your site requires.
The standalone http2 directive is documented in HTTP and server contexts and appeared in Nginx 1.25.1. If your installed release predates that directive, follow that release’s documentation and upgrade planning; do not silently assume that a configuration written for a newer release will parse on an older binary.
Migrate older listen ... http2 configurations
Older guides often show this form:
listen 443 ssl http2;Nginx’s developer documentation identifies enabling HTTP/2 through the listen ... http2 parameter as deprecated and describes the standalone directive as the newer approach. On a current release, change the server block to:
listen 443 ssl;
http2 on;Keep the port and TLS setting on listen; move only the HTTP/2 switch. A deprecation warning is not the same as a negotiation failure, but leaving the old form in place can create avoidable warnings and future upgrade work. Make the change in the virtual server that actually receives the request, not just in an unused sample file.
Test and reload Nginx safely
Never reload an untested configuration. The common validation command is:
sudo nginx -tA successful result should report that the syntax is valid and the configuration test is successful. Treat every error as actionable before proceeding. Typical causes include a typo in http2, an unknown directive because the module is missing, a certificate path that does not exist, a private-key permission problem, an unmatched brace, or a duplicate/conflicting listener.
After the test succeeds, reload the running service without terminating existing workers:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorssudo nginx -s reloadMany operating systems expose the same operation through their service manager, for example a service-specific reload action. Use the command documented for your installation. Check the service status and error log after the reload; a command returning immediately does not prove that every worker accepted the new configuration.
- Save a copy of the last known-good configuration.
- Run
nginx -twith the same binary and configuration path used by the service. - Correct every reported error and repeat the test until it succeeds.
- Reload Nginx with
nginx -s reloador the service manager’s reload action. - Confirm that the process remains healthy and inspect the error log for certificate, permission or listener messages.
- Test the public hostname, not only an IP address, so SNI selects the intended virtual server.
Verify that clients negotiated HTTP/2
Use browser developer tools
Open the site over https://, open developer tools, and inspect the Network panel. Enable the protocol or connection column if it is hidden. A successful negotiation is shown as HTTP/2 (browser wording varies). Check the certificate details at the same time: an invalid chain, hostname mismatch or expired certificate can force the connection to fail before protocol negotiation.
Best Value
Test a private window or a fresh browser session when diagnosing cached redirects. Also test the exact hostname in the certificate; an alternate alias may be routed to a different TLS server block.
Use an HTTP client that reports the protocol
If your installed client supports HTTP/2, request the HTTPS URL explicitly and inspect verbose output:
curl --http2 -I -v https://example.com/The verbose handshake should show ALPN negotiation and an HTTP/2 response. A client built without HTTP/2 support will reject the option or use HTTP/1.1; that result describes the client, not necessarily Nginx. Run curl --version and check its listed features before drawing a conclusion.
Do not test with plain http:// and expect the same result. The configuration above redirects port 80 to TLS, and browser HTTP/2 support is normally established on the HTTPS connection.
Troubleshoot when HTTP/2 is not negotiated
| Symptom | Likely cause | Checks and remedy |
|---|---|---|
unknown directive "http2" |
The binary lacks ngx_http_v2_module, or it is older than the release that introduced the standalone directive. |
Run nginx -V 2>&1. Install a build containing --with-http_v2_module or rebuild with that option. Confirm the release supports http2 on;. |
A warning says listen ... http2 is deprecated |
The configuration uses the legacy listener parameter. | Use listen 443 ssl; and add http2 on; at server level. |
| The site serves HTTPS but reports HTTP/1.1 | ALPN is unavailable, the client lacks HTTP/2 support, or the request reached another virtual server. | Check the OpenSSL library linked to Nginx, the client’s HTTP/2 capability, DNS, SNI and the selected certificate. Verify the intended server block is loaded. |
| Nginx fails its configuration test | A path, permission, syntax or module error exists. | Read the exact line in the test output. Check certificate/key paths, key readability, braces, directive spelling and module availability before retrying. |
| The certificate is rejected | The chain is incomplete, the hostname is absent, the certificate is expired, or the key does not match. | Inspect the certificate names and validity, install the supplied chain, and verify that the private key belongs to that certificate. |
| Reload appears successful but behavior is unchanged | The wrong binary, configuration file or virtual server was reloaded, or the request is cached/routed elsewhere. | Compare the service’s executable and configuration paths with the ones tested, inspect the active logs, and test the public hostname over a new connection. |
Check the intended TLS virtual server
Nginx chooses among TLS virtual servers using the address, port and SNI hostname. An HTTP/2-enabled block is irrelevant if DNS points elsewhere, the request uses an unlisted alias, or another default server presents the certificate first. Confirm that the certificate observed by the client belongs to the server block you edited and that all expected names appear in its server_name.
Check ALPN and the linked OpenSSL
HTTP/2 over TLS depends on ALPN during the handshake. Nginx documents support for this path with OpenSSL 1.0.2 and later. The OpenSSL installed on the host is not necessarily the library linked into the Nginx binary, so use nginx -V and the package’s build information when checking. If the linked library is too old or the client does not offer HTTP/2, the connection can remain on HTTP/1.1 even though the server block is correct.
Recommended Free Tools
Choose a package or source build deliberately
| Deployment choice | Advantages | Trade-offs to plan for |
|---|---|---|
| Operating-system or official Nginx package | Package updates, service integration and established file locations are usually handled for you. | The exact Nginx version, module set and OpenSSL build are determined by the repository; verify that HTTP/2 is included. |
Source build with --with-http_v2_module |
You control the Nginx version, configure options and linked dependencies. | You own compilation, upgrades, patching, service integration, paths and rollback procedures. |
Evaluate either option on four practical axes: whether the package contains the module, which TLS/OpenSSL version is linked, how certificates are issued and renewed, and how reloads and logs are operated. HTTP/2 is only one part of the deployment; a build that cannot be patched or reloaded safely is not an operational improvement.
Security and operations checklist
- Use a certificate whose names match every public hostname in the HTTPS server block.
- Protect the private key with restrictive filesystem permissions and the correct service ownership.
- Keep the certificate chain current and test renewal before the existing certificate expires.
- Redirect port 80 deliberately, while ensuring health checks, ACME validation or other required exceptions still work for your environment.
- Use
nginx -tbefore every reload, including certificate renewals and automated deployments. - Reload rather than stopping the service when the change only requires configuration replacement, then verify worker and error-log status.
- Record the Nginx binary path, configuration path, module arguments and OpenSSL linkage so future administrators test the correct installation.
- Verify HTTP/2 from an external client after deployment; a local test against a different listener does not prove public negotiation.
What success looks like
A correct deployment has an HTTP server on port 80 that redirects to the HTTPS hostname, an HTTPS server on port 443 with listen 443 ssl;, a valid certificate and key, and http2 on; in the server context. The running Nginx binary contains ngx_http_v2_module, the linked TLS library supports ALPN, nginx -t passes, and a browser or HTTP/2-capable client reports HTTP/2 for a fresh HTTPS connection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
