3 ms·

While we're on the topic of Debian, am I the only one who finds it odd that Debian Jessie is apparently never going to support HTTP/2? It seems an unfortunate d

While we're on the topic of Debian, am I the only one who finds it odd that Debian Jessie is apparently never going to support HTTP/2? It seems an unfortunate decision was made at some point to skip OpenSSL 1.0.2: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767661 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767661 Nowhere have I been able to find any information regarding plans to backport OpenSSL 1.0.2+ to Jessie. With Google turning off SPDY in Chrome next month, the lack of HTTP/2 support makes Debian a rather poor environment as a web server. I hope someone will point out that I'm wrong and that I've horribly misunderstood the current state of affairs. Otherwise, it seems like strong motivation to migrate our web applications to Ubuntu Xenial.

Ambroos 11y ago
Nope, it's accurate (and a shame). We've split up our SSL termination for this exact reason. Instead of doing SSL and HTTP/2 on our application servers themselves, we put a box with Debian Stretch in front of it doing just proxying and stapling on HTTP/2 + SSL. Since the box has just one very limited responsibility that's easy to test we can afford running unstable software at that point.
lamby 11y ago
> Debian Jessie is apparently never going to support HTTP/2? I suppose it depends on what you mean. The, say, nginx package in jessie itself won't get new features (by design) but the backports repositories -- which are now official -- have an nginx that supports HTTP/2. Am happily serving HTTP/2 from jessie right now :)
- Ambroos 11y ago
  Unfortunately, since you don't have OpenSSL 1.0.2, you are only negotiating HTTP/2 over NPN, which Chrome will drop together with SPDY. To still get Chrome to negotiate HTTP/2 after the SPDY+NPN drop, you will need ALPN. Which is only supported in OpenSSL 1.0.2+.

3 ms·

While we're on the topic of Debian, am I the only one who finds it odd that Debian Jessie is apparently never going to support HTTP/2? It seems an unfortunate d

by justinmayer 11y ago

Ambroos 11y ago
Nope, it's accurate (and a shame). We've split up our SSL termination for this exact reason. Instead of doing SSL and HTTP/2 on our application servers themselves, we put a box with Debian Stretch in front of it doing just proxying and stapling on HTTP/2 + SSL. Since the box has just one very limited responsibility that's easy to test we can afford running unstable software at that point.
lamby 11y ago
> Debian Jessie is apparently never going to support HTTP/2? I suppose it depends on what you mean. The, say, nginx package in jessie itself won't get new features (by design) but the backports repositories -- which are now official -- have an nginx that supports HTTP/2. Am happily serving HTTP/2 from jessie right now :)
- Ambroos 11y ago
  Unfortunately, since you don't have OpenSSL 1.0.2, you are only negotiating HTTP/2 over NPN, which Chrome will drop together with SPDY. To still get Chrome to negotiate HTTP/2 after the SPDY+NPN drop, you will need ALPN. Which is only supported in OpenSSL 1.0.2+.