OpenSSL 3.2 Released With Client-Side QUIC, SSL/TLS Security Level 2 Default

[Jabberwocky]

I know HTTP/3 sits on top of a QUIC layer (which itself sits on top of UPD), whereas previous versions of HTTP sit on top of TCP. I see a lot of open source projects out there that support up to HTTP/2, but not HTTP/3 yet. I am not fully versed on how/when/where these various projects might use OpenSSL as the encryption layer, but if they do, could this be why HTTP/3 support is not implemented yet (i.e. lack of QUIC support in the OpenSSL library)? If yes, happy to see the support coming. Maybe OpenSSL is not used at all here and I am missing something, but was something that came to mind for me.

I agree 100% with what Jakobson said. Just to add to it.

These HTTP/3 features have been researched, discussed and tested for a very long time and yet there are still some unknowns around the implementations and practical benifit. It could either be that some of the projects are waiting for this new OpenSSL 3.2 release (it has been a long time coming) or that the project simply doesn't see HTTP/3 or QUIC as a priority for them. I would also suggest if you don't need any HTTP/3 features then stick with HTTP/2 for a few years.

For example: I have been using QUIC standalone (without HTTP/3) for redundant voice communication over multiple WAN connections. I have not seen the need to update my web server to support QUIC because the performance improvements doesn't outweigh the management costs in my niche use case.

If you want to get your hands dirty I would suggest to take a look how Quiche (cloudflare), Nginx, Caddy, A̶p̶a̶c̶h̶e̶, Jetty and others have decided to make use of HTTP/3. You could also read some of the docs or specs: https://github.com/bagder/http3-expl...ter/SUMMARY.md and https://datatracker.ietf.org/doc/html/rfc9000

PS: It will take many years for me to finish learning and understanding the entire spec in my own time.

[lucrus]

Apache [...] decided to make use of HTTP/3 [...]

Any links about that? Just a few days ago I struggled finding anything about Apache and HTTP/3 support.

[ehansin]

I agree 100% with what Jakobson said. Just to add to it.

Thank you as well for your input here - much appreciated!

[bnolsen]

I anticipate most packages skipping or deprecating h2 support entirely and just going with http1.1 and http3/quic.

[Jabberwocky]

Any links about that? Just a few days ago I struggled finding anything about Apache and HTTP/3 support.

I have mistaken Nginx threads for Apache. It doesn't look like Apache still has plans for HTTP/3 https://bz.apache.org/bugzilla/show_bug.cgi?id=64462

OpenSSL 3.2 is ABI compatible with prior 3.x releases so you can use it as a drop in replacement with Apache which could make it easier to add features without needing to fork Apache. I'm not sure if it's possible to add QUIC support via plugins.