Configure HTTP/2 on the origin

Orange's CDN edge servers support HTTP/2 and enable it by default. When a client browser supports HTTP/2 and the CDN resource uses HTTPS, the CDN can deliver content over HTTP/2.

Browsers use HTTP/2 only over HTTPS. Add an SSL certificate to the CDN resource to secure the client-to-CDN connection.

Orange's CDN uses HTTP/1.1 for origin requests and does not connect to origins over HTTP/2 or cleartext h2c. Enabling HTTP/2 on the origin therefore does not improve the CDN-to-origin connection; it benefits clients and other services that connect directly to the origin with HTTP/2.

For direct HTTP/2 over TLS, the origin needs its own HTTPS configuration, certificate, and ALPN-capable TLS stack. The CDN resource certificate covers only the client-to-CDN connection and does not configure HTTPS or ALPN on the origin.

Nginx configuration

Nginx 1.9.5 or later with the HTTP/2 module is required.

Open the HTTPS server block in the Nginx configuration (often /etc/nginx/nginx.conf or a file under /etc/nginx/sites-available/).
Enable HTTP/2 with the syntax for the installed version.

For Nginx 1.25.1 and later, use:
```
listen 443 ssl;
http2 on;
```
For Nginx 1.9.5 through 1.25.0, use:
```
listen 443 ssl http2;
```
For cleartext h2c on Nginx 1.25.1 and later, use:
```
listen 80;
http2 on;
```
For cleartext h2c on Nginx 1.9.5 through 1.25.0, use:
```
listen 80 http2;
```
Nginx does not negotiate h2c through an HTTP/1.1 Upgrade request, so clients must start HTTP/2 with prior knowledge. In versions before 1.25.1, an h2c socket accepts only HTTP/2; assign a dedicated port if HTTP/1.x clients must remain supported. Starting with version 1.25.1, the socket detects the HTTP/2 connection preface and otherwise uses HTTP/1.x.

Test and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Apache configuration

Apache 2.4.17 or later is required. HTTP/2 over TLS also requires an ALPN-capable TLS library.

Enable the mod_http2 module (also known as mod_h2).

Add the matching Protocols line to the virtual host configuration:

# HTTPS
Protocols h2 http/1.1

# HTTP (cleartext HTTP/2)
Protocols h2c http/1.1

Check the configuration:
```
sudo apachectl configtest
```
If the check returns Syntax OK, reload or restart Apache with the command for the operating system. On systems that use the apache2 systemd service, run:
```
sudo systemctl reload apache2
```

Origin verification

Test the origin directly after enabling HTTP/2.

For HTTP/2 over TLS, run:

curl --http2 -I https://origin.example.com

Confirm that the first response status line starts with HTTP/2. This test uses the origin hostname and certificate, not the CDN custom domain or CDN resource certificate.

If the origin supports cleartext h2c, test it separately:

curl --http2-prior-knowledge -I http://origin.example.com

Confirm that the first response status line starts with HTTP/2.

Benefits for direct origin connections

These benefits apply only to clients or services that connect directly to the origin over HTTP/2, not to Orange's CDN origin requests. A direct client can reuse a single TCP connection for many requests, which reduces connection overhead compared with opening parallel HTTP/1.1 connections and avoids splitting assets across hostnames to raise connection limits.