Nginx on ma.ttias.be

Serving HTTP/2 and HTTP/3 with Nginx in 2026

mattias@ma.ttias.be (Mattias Geniar) — Tue, 02 Jun 2026 00:00:00 +0000

Back in 2016 I wrapped nginx in a Docker container just to get HTTP/2 working. Not because I love Docker, but because the server’s OpenSSL was too old to do ALPN, and the cleanest way to borrow a modern OpenSSL was to lift one out of an Alpine container. It worked, but it was a hack, and I knew it at the time.

Nginx: add_header not working on 404

mattias@ma.ttias.be (Mattias Geniar) — Fri, 07 Jun 2019 09:41:28 +0000

I had the following configuration block on an Nginx proxy.

server {
 listen 80 default;
 add_header X-Robots-Tag noindex;
 ...
}

The idea was to add the X-Robots-Tag header on all requests being served. However, it didn’t work for 404 hits.

Deploying laravel-websockets with Nginx reverse proxy and supervisord

mattias@ma.ttias.be (Mattias Geniar) — Tue, 04 Dec 2018 22:18:57 +0000

There is a new PHP package available for Laravel users called laravel-websockets that allows you to quickly start a websocket server for your applications.

Nginx adds support for HTTP/2 Server-Side Push

mattias@ma.ttias.be (Mattias Geniar) — Tue, 13 Feb 2018 08:34:01 +0000

Looks like they’ll be implementing it based on the Link header, which should make it trivial to implement from a developer point of view.

cron.weekly issue #97: kernel 4.13, TLS, LLVM, Yarn, Vagrant, AWX, Nginx & more

mattias@ma.ttias.be (Mattias Geniar) — Mon, 11 Sep 2017 07:30:04 +0000

Quite the packed issue, I’m very happy with how this one turned out.

Welcome to cron.weekly issue #97 for Sunday, September 10th, 2017.

RHEL & CentOS 7.4 restores HTTP/2 functionality on Nginx

mattias@ma.ttias.be (Mattias Geniar) — Tue, 01 Aug 2017 18:01:45 +0000

Red Hat Enterprise Linux 7.4 has just been released , and with it, a much-awaited (at least by me) update to OpenSSL, bringing it to version 1.0.2k.

How to enable TLS 1.3 on Nginx

mattias@ma.ttias.be (Mattias Geniar) — Tue, 02 May 2017 06:45:29 +0000

Since Nginx 1.13 , support has been added for TLSv1.3, the latest version of the TLS protocol. Depending on when you read this post, chances are you’re running an older version of Nginx at the moment, which doesn’t yet support TLS 1.3. In that case, consider running Nginx in a container for the latest version, or compiling Nginx from source.

Nginx might have 33% market share, Apache isn’t falling below 50%

mattias@ma.ttias.be (Mattias Geniar) — Tue, 11 Apr 2017 19:51:41 +0000

This is a response to a post published by W3 Techs titled “Nginx reaches 33.3% web server market share while Apache falls below 50% ”. It’s gotten massive upvotes on Hacker News , but I believe it’s a fundamentally flawed post.

Run Nginx proxy in Docker container for HTTP/2

mattias@ma.ttias.be (Mattias Geniar) — Sun, 30 Oct 2016 14:02:30 +0000

This is a really quick write-up on how I’ve been running HTTP/2 on my server for the last 2 months, despite having an OS that doesn’t support OpenSSL 1.0.2 .

The day Google Chrome disables HTTP/2 for nearly everyone: May 31st, 2016

mattias@ma.ttias.be (Mattias Geniar) — Sat, 14 May 2016 12:28:56 +0000

If you’ve been reading this blog for a while (or have been reading my rants on Twitter ), you’ll probably know this was coming already. If you haven’t, here’s the short version.

Nginx 1.10 brings HTTP/2 support to the stable releases

mattias@ma.ttias.be (Mattias Geniar) — Tue, 26 Apr 2016 19:24:03 +0000

A very small update was sent to the nginx-announce mailing list today. And I do mean very small:

nginx-1.9.13: no longer retry non-idempotent upstream requests by default

mattias@ma.ttias.be (Mattias Geniar) — Tue, 29 Mar 2016 17:16:10 +0000

Release 1.9.13 of Nginx, just out a couple of hours ago, fixes a long standing bug : non-idempotent requests could be resent to another upstream, potentially causing multiple form submits, multiple deletes, …

Nginx Proxy: upstream sent too big header while reading response header from upstream

mattias@ma.ttias.be (Mattias Geniar) — Fri, 11 Mar 2016 21:30:20 +0000

If you’re running an Nginx proxy configuration, you can run into the following error in your logs.

Chrome drops NPN support for HTTP/2, ALPN only

mattias@ma.ttias.be (Mattias Geniar) — Mon, 16 Nov 2015 13:11:01 +0000

~~Update 23/11/2015: Chrome reverted the change, NPN is allowed again!~~ More details below.

Update 14/02/2016: Chrome will, as of May 15th 2016, only support HTTP/2 via ALPN. NPN supported is dropped (source ).

Update 11/05/2015: We’re still doomed, Chrome is scheduled to release a new update on May 15th 2016 that switches from NPN to ALPN, requiring OpenSSL 1.0.2 in order to further support HTTP/2. More details below.

If this cryptic title doesn’t mean much to you, let me rephrase it in more words: Chrome is switching to the newer Application-Layer Protocol Negotiation (ALPN) extension for TLS negotiation. ALPN requires at least OpenSSL 1.0.2. Right now, Red Hat Enterprise Linux, CentOS, Ubuntu and Debian only support up to OpenSSL 1.0.1.

Basically, Chrome just made it damn near impossible to run HTTP/2 on a Linux server without some serious OpenSSL hackery.

Nginx: Cannot assign requested address for upstream

mattias@ma.ttias.be (Mattias Geniar) — Mon, 02 Nov 2015 20:42:59 +0000

A few days ago, I ran into the following interesting Nginx error message.

Enable Keepalive connections in Nginx Upstream proxy configurations

mattias@ma.ttias.be (Mattias Geniar) — Tue, 27 Oct 2015 20:17:00 +0000

A very common setup to see nowadays is to have an Nginx SSL proxy in front of a Varnish configuration, that handles all the SSL configurations while Varnish still maintains the caching abilities.

Enable HTTP/2 in Nginx

mattias@ma.ttias.be (Mattias Geniar) — Tue, 22 Sep 2015 18:46:10 +0000

As of nginx 1.9.5 , there is experimental support for HTTP/2. This article will show you how to enable HTTP/2 support in your Nginx configuration. This can be enabled or disabled per vhost, it does not have to be enabled server-wide.

Nginx SSL Certificate Errors: PEM_read_bio_X509_AUX, PEM_read_bio_X509, SSL_CTX_use_PrivateKey_file

mattias@ma.ttias.be (Mattias Geniar) — Thu, 13 Aug 2015 19:28:04 +0000

When configuring your SSL certificates on Nginx, it’s not uncommon to see several errors when you try to reload your Nginx configuration, to activate the SSL Certificates.

Increasing Nginx Performance With Thread Pooling

mattias@ma.ttias.be (Mattias Geniar) — Thu, 18 Jun 2015 20:00:18 +0000

Fascinating stuff .

Nginx Open Sources TCP Load Balancing

mattias@ma.ttias.be (Mattias Geniar) — Mon, 20 Apr 2015 16:22:19 +0000

A move we can only applaud.

Nginx HTTP/2 Support Coming Late 2015

mattias@ma.ttias.be (Mattias Geniar) — Tue, 14 Apr 2015 18:14:42 +0000

As anticipated.

Nginx Getting JavaScript Scripting Engine

mattias@ma.ttias.be (Mattias Geniar) — Tue, 14 Apr 2015 18:11:33 +0000

I missed the original hint in October 2014 , so this came as a surprise to me.

Nginx sets HTTP 200 OK on PHP-FPM parse errors

mattias@ma.ttias.be (Mattias Geniar) — Mon, 19 Jan 2015 16:42:48 +0000

Here’s an interesting bit of behaviour. When a PHP error occurs in a PHP-FPM pool, nginx can still reply with a HTTP 200 status code – indicating everything is OK – if the PHP script returns output.

Architecting Websites For The HTTP/2 Era

mattias@ma.ttias.be (Mattias Geniar) — Tue, 06 Jan 2015 21:07:41 +0000

The arrival of HTTP/2 will require a bit of re-thinking how we handle websites (and webservers) . This makes it a good time to reflect on what those changes can bring.

This post is based entirely on theory (the HTTP2 spec) , as HTTP/2 is hard to test today. Major browsers support HTTP/2 , but very little servers do. And often, it’s unclear which draft of the HTTP/2 spec they do support.

The entire HTTP/2 Spec is available for reading on Github and is highly recommended. It covers a lot more edge-cases than this article does.

And if you’re up for a bit more reading, the HTTP/1.1 spec is also worth it , if only for comparisons’ sake.

Undoing Years of Optimisations With HTTP/2

mattias@ma.ttias.be (Mattias Geniar) — Fri, 26 Dec 2014 08:25:53 +0000

Someone just released an HTTP server called H2O, which is significantly faster than Nginx (especially for small files). This in itself is an accomplishment, but the reason for this development is even more important.