Encryption is de facto mandatory to use http/2:
Although the standard itself does not require usage of encryption, all
major client implementations (Firefox, Chrome, Safari, Opera, IE,
Edge) have stated that they will only support HTTP/2 over TLS ...
So you'll need a fully configured SSLHostConfig
with Certificate
in order to run HTTP/2 over TLS.
A connector like this may work for you:
<Connector SSLEnabled="true" maxThreads="150" port="8443"
protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https"
secure="true"
sslImplementationName="org.apache.tomcat.util.net.openssl.OpenSSLImplementation">
<SSLHostConfig certificateVerification="none"
sslProtocol="TLS">
<Certificate certificateKeyAlias="myKeyAlias"
certificateKeystoreFile="/path/to/my/keystore.jks"
certificateKeystorePassword="myPassword"
certificateKeystoreType="JKS">
</Certificate>
</SSLHostConfig>
<UpgradeProtocol
className="org.apache.coyote.http2.Http2Protocol" />
</Connector>
If you want to use NIO2, change protocol
to org.apache.coyote.http11.Http11Nio2Protocol
.
If you want to use SSL without OpenSSL but use the java implementation JSSE instead, change sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
(if provided by your JRE).
Despite the fact that browsers won't upgrade to http/2 on unencrypted connections, it's technically possible to configure a http/2 connector on Apache Tomcat without SSL and use it e.g. with CURL - manually enforcing the http/2 upgrade:
<Connector SSLEnabled="false" maxThreads="150" port="8444" protocol="org.apache.coyote.http11.Http11NioProtocol" secure="false">
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol"/>
</Connector>
CURL debug output:
$ curl http://localhost:8444 -v --http2
...
* Connected to localhost (::1) port 8444 (#0)
> GET / HTTP/1.1
> Host: localhost:8444
> User-Agent: curl/7.60.0
> Accept: */*
> Connection: Upgrade, HTTP2-Settings
> Upgrade: h2c
> HTTP2-Settings: AAMAAABkAARAAAAAAAIAAAAA
>
< HTTP/1.1 101
< Connection: Upgrade
< Upgrade: h2c
< Date: Mon, 28 Oct 2019 12:06:18 GMT
* Received 101
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Connection state changed (MAX_CONCURRENT_STREAMS == 200)!
< HTTP/2 200
< content-type: text/html;charset=UTF-8
< date: Mon, 28 Oct 2019 12:06:18 GMT
<