> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure HTTP/2 on the origin

Gcore CDN edge servers support HTTP/2 and enable it by default. When a client browser supports HTTP/2 and the CDN resource uses HTTPS, the CDN can deliver content over HTTP/2.

Browsers use HTTP/2 only over HTTPS. Add an [SSL certificate](/cdn/ssl-certificates/add-an-ssl-certificate-to-deliver-content-over-https) to the CDN resource to secure the client-to-CDN connection.

Gcore CDN uses HTTP/1.1 for origin requests and does not connect to origins over HTTP/2 or cleartext `h2c`. Enabling HTTP/2 on the origin therefore does not improve the CDN-to-origin connection; it benefits clients and other services that connect directly to the origin with HTTP/2.

For direct HTTP/2 over TLS, the origin needs its own HTTPS configuration, certificate, and ALPN-capable TLS stack. The CDN resource certificate covers only the client-to-CDN connection and does not configure HTTPS or ALPN on the origin.

## Nginx configuration

Nginx 1.9.5 or later with the [HTTP/2 module](https://nginx.org/en/docs/http/ngx_http_v2_module.html) is required.

1. Open the HTTPS `server` block in the Nginx configuration (often `/etc/nginx/nginx.conf` or a file under `/etc/nginx/sites-available/`).

2. Enable HTTP/2 with the syntax for the installed version.

   For Nginx 1.25.1 and later, use:

   ```nginx theme={null}
   listen 443 ssl;
   http2 on;
   ```

   For Nginx 1.9.5 through 1.25.0, use:

   ```nginx theme={null}
   listen 443 ssl http2;
   ```

   For cleartext `h2c` on Nginx 1.25.1 and later, use:

   ```nginx theme={null}
   listen 80;
   http2 on;
   ```

   For cleartext `h2c` on Nginx 1.9.5 through 1.25.0, use:

   ```nginx theme={null}
   listen 80 http2;
   ```

   Nginx does not negotiate `h2c` through an HTTP/1.1 Upgrade request, so clients must start HTTP/2 with prior knowledge. In versions before 1.25.1, an `h2c` socket accepts only HTTP/2; assign a dedicated port if HTTP/1.x clients must remain supported. Starting with version 1.25.1, the socket detects the HTTP/2 connection preface and otherwise uses HTTP/1.x.

3. Test and reload Nginx:

   ```bash theme={null}
   sudo nginx -t
   sudo systemctl reload nginx
   ```

## Apache configuration

Apache 2.4.17 or later is required. HTTP/2 over TLS also requires an ALPN-capable TLS library.

1. Enable the [`mod_http2`](https://httpd.apache.org/docs/2.4/mod/mod_http2.html) module (also known as `mod_h2`).

2. Add the matching `Protocols` line to the virtual host configuration:

   ```apache theme={null}
   # HTTPS
   Protocols h2 http/1.1
   ```

   ```apache theme={null}
   # HTTP (cleartext HTTP/2)
   Protocols h2c http/1.1
   ```

3. Check the configuration:

   ```bash theme={null}
   sudo apachectl configtest
   ```

4. If the check returns `Syntax OK`, reload or restart Apache with the command for the operating system. On systems that use the `apache2` systemd service, run:

   ```bash theme={null}
   sudo systemctl reload apache2
   ```

## Origin verification

Test the origin directly after enabling HTTP/2.

For HTTP/2 over TLS, run:

```bash theme={null}
curl --http2 -I https://origin.example.com
```

Confirm that the first response status line starts with `HTTP/2`. This test uses the origin hostname and certificate, not the CDN custom domain or CDN resource certificate.

If the origin supports cleartext `h2c`, test it separately:

```bash theme={null}
curl --http2-prior-knowledge -I http://origin.example.com
```

Confirm that the first response status line starts with `HTTP/2`.

## Benefits for direct origin connections

These benefits apply only to clients or services that connect directly to the origin over HTTP/2, not to Gcore CDN origin requests. A direct client can reuse a single TCP connection for many requests, which reduces connection overhead compared with opening parallel HTTP/1.1 connections and avoids splitting assets across hostnames to raise connection limits.