NetScaler SSL VIP configured for HTTP2 uses HTTP/1.1 despite enabling HTTP/2 on the VIP
book
Article ID: CTX225300
calendar_today
Updated On:
Description
You see that your SSL VIP is using HTTP/1.1 despite having configured HTTP/2.
You confirm using Developer tools:
- Press F12 in Chrome/Firefox
- Choose the Network Tab.
- Load / Refresh the HTTPS page.
- In Firefox, click one of the items that has loaded in the list. In Chrome, right-click the column headers and ensure Protocol is checked.
- In Firefox, you will see the Protocol on the side so long as the Headers tab is selected. In Chrome you will see the HTTP version in the Protocol column. Note in the examples below, we see that Yahoo is successfully utilizing HTTP/2.


NOTE: HTTP2 is currently only implemented with SSL (HTTPS) and there are no browsers that support for HTTP/2 for insecure HTTP.
Resolution
Below are the items that must be configured properly on the Vserver for HTTP/2 to work.
1. HTTP/2 must be enabled in the Profile and set on the Vserver.
Using CLI
- Enable Globally:
set ns httpProfile nshttp_default_profile -http2 enabled - Enable with a new Profile where the name of the HTTP profile is "nshttp_http2":
add ns httpprofile nshttp_http2 -http2 enabled - Bind the Global or New profile to your Vserver, in this case the Vserver is named TestVserver and I bind the new HTTP Profile created above:
set lb vserver TestVserver -httpprofileName nshttp_http2
Using GUI
- Navigate to System->Profiles->HTTP Profiles and click Add.
- Enter the Name of the Profile.
- Check HTTP/2
- Click Create.

- Now Edit your Vserver.
- If Profiles is not shown, click it under Advanced Settings.

- Click the Pencil at the upper right section of Profiles to edit them.
- Under HTTP Profile, select the newly created/modified HTTP Profile.
- Click Ok.
2. TLS 1.2 must be enabled on the Vserver
Using CLI
Run this command:
set ssl vserver testVserver -tls12 enabled
Using GUI
- Edit your Vserver
- If SSL Parameters is not shown, click it under Advanced Settings
- Click the Edit Pencil at the top right of SSL Parameters.
- Check TLSv12
- Click Ok

3. Some Ciphers do not support HTTP/2 so Bind the Default Cipher group to the Vserver.
Using CLI
bind ssl vserver testVserver -cipherName Default
Using GUI
- Edit your Vserver
- If SSL Ciphers is not shown, click it under Advanced Settings
- Click the Pencil at the top right of SSL Ciphers to edit them.
- Remove all ciphers, then add the DEFAULT cipher group.
- Click Ok

4. ECC curves must be bound to the Vserver
Using CLI
bind ssl vserver testVserver -ecccurvename ALL
Using GUI
- Edit your Vserver
- If ECC Curve is not shown, click it under Advanced Settings
- Click the > at the right of ECC Curves.
- Select ALL and click Select.

Note: If you are using a CS VIP, then HTTP/2 needs to be enabled on the CS VIP, not the LB Vserver the CS VIP points to. Also, it's Ok if the LB Vserver has a HTTP service group.
Problem Cause
HTTP/2 requires specific Ciphers. These Ciphers can only be used when the NetScaler is properly configured. This configuration involves TLS1.2, ECC Curves, Proper Ciphers, and HTTP/2 being enabled in the Vserver's HTTP Profile.
Issue/Introduction
What to look for when you have configured HTTP/2 on an SSL LB or CS VIP but it continues to use HTTP/1.1
Additional Information
http://docs.citrix.com/en-us/netscaler/11/system/http-configurations/configuring-http2.html
Was this article helpful?
thumb_up
Yes
thumb_down
No