Understanding different values for nginx 'listen' directive
listen 443 ssl : makes nginx listen on all ipv4 address on the server, on port 443 (
listen [::]:443 ssl : makes nginx listen on all ipv6 address on the server, on port 443 (
[::]:443 will not make nginx respond on ipv4 by default, unless you specify parameter
listen [::]:443 ipv6only=off;
As per the doc : http://nginx.org/en/docs/http/ngx_http_core_module.html#listen
The ssl parameter (0.7.14) allows specifying that all connections accepted on this port should work in SSL mode.
The http2 parameter (1.9.5) configures the port to accept HTTP/2 connections.
This doesn't mean it accepts only HTTP/2 connections.
As per RFC7540
A client that makes a request for an "http" URI without prior knowledge about support for HTTP/2 on the next hop uses the HTTP Upgrade mechanism. The client does so by making an HTTP/1.1 request that includes an Upgrade header field with the "h2c" token.
A server that does not support HTTP/2 can respond to the request as though the Upgrade header field were absent.
HTTP/1.1 200 OK Content-Length: 243 Content-Type: text/html
A server that supports HTTP/2 accepts the upgrade with a 101 (Switching Protocols) response. After the empty line that terminates the 101 response, the server can begin sending HTTP/2 frames.
To summarize :
A client that does not support HTTP/2 will never ask the server for an HTTP/2 communication upgrade : the communication between them will be fully HTTP1/1.
A client that supports HTTP/2 will ask the server (using HTTP1/1) for an HTTP/2 upgrade :
- If the server is HTTP/2 ready, then the server will notice the client as such : the communication between them will be switched to HTTP/2.
- If the server is not HTTP/2 ready, then the server will ignore the upgrade request answering with HTTP1/1 : the communication between them should stay plenty HTTP1/1.
Maybe more summarized here : http://qnimate.com/http2-compatibility-with-old-browsers-and-servers/
However the nginx doc states the following about HTTP/2 over TLS :
Note that accepting HTTP/2 connections over TLS requires the “Application-Layer Protocol Negotiation” (ALPN) TLS extension support, which is available only since OpenSSL version 1.0.2.
Make sure old clients are compliant with this requirement.