HTTP/3 を試してみる

$ curl --version
curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.63.0
Release-Date: 2024-03-27
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM SPNEGO SSL threadsafe UnixSockets

$ curl --http3 -v https://cloudflare-quic.com
curl: option --http3: the installed libcurl version doesn't support this
curl: try 'curl --help' or 'curl --manual' for more information

# Build OpenSSL (version 3.5.0 or newer):
$ git clone --quiet --depth=1 -b openssl-$OPENSSL_VERSION https://github.com/openssl/openssl
$ cd openssl
$ ./config --prefix=<somewhere1> --libdir=lib
$ make
$ make install

# Build nghttp3:
$ cd ..
$ git clone -b $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3
$ cd nghttp3
$ git submodule update --init
$ autoreconf -fi
$ ./configure --prefix=<somewhere2> --enable-lib-only
$ make
$ make install

# Build ngtcp2:
$ cd ..
$ git clone -b $NGTCP2_VERSION https://github.com/ngtcp2/ngtcp2
$ cd ngtcp2
$ autoreconf -fi
$ ./configure PKG_CONFIG_PATH=<somewhere1>/lib/pkgconfig:<somewhere2>/lib/pkgconfig LDFLAGS="-Wl,-rpath,<somewhere1>/lib" --prefix=<somewhere3> --enable-lib-only --with-openssl
$ make
$ make install

# Build curl:
$ cd ..
$ git clone https://github.com/curl/curl
$ cd curl
$ autoreconf -fi
$ LDFLAGS="-Wl,-rpath,<somewhere1>/lib" ./configure PKG_CONFIG_PATH=<ngtcp2-root>/lib/pkgconfig --with-openssl=<somewhere1> --with-nghttp3=<somewhere2> --with-ngtcp2
$ make
$ make install

$ brew tap catatsuy/tap
$ brew install curl-http3-libressl

$ which curl
/opt/homebrew/bin/curl

$ curl --version
curl 8.16.0 (aarch64-apple-darwin24.2.0) libcurl/8.16.0 LibreSSL/4.1.0 zlib/1.2.12 brotli/1.1.0 zstd/1.5.7 libidn2/2.3.8 nghttp2/1.65.0 ngtcp2/1.15.1 nghttp3/1.11.0 librtmp/2.3
Release-Date: 2025-09-10
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Largefile libz NTLM SSL threadsafe UnixSockets zstd

$ curl --http3 -v https://cloudflare-quic.com | head
* Established connection to cloudflare-quic.com (104.18.26.14 port 443) from 192.168.1.14 port 62879
* using HTTP/3
* [HTTP/3] [0] OPENED stream for https://cloudflare-quic.com/
* [HTTP/3] [0] [:method: GET]
* [HTTP/3] [0] [:scheme: https]
* [HTTP/3] [0] [:authority: cloudflare-quic.com]
* [HTTP/3] [0] [:path: /]
* [HTTP/3] [0] [user-agent: curl/8.16.0]
* [HTTP/3] [0] [accept: */*]
> GET / HTTP/3
> Host: cloudflare-quic.com
> User-Agent: curl/8.16.0
> Accept: */*
>
* Request completely sent off
< HTTP/3 200
< date: Wed, 08 Oct 2025 05:48:39 GMT
< content-type: text/html
< cf-ray: 98b359b9ff3dd5cf-NRT
< priority: u=3,i=?0
< server: cloudflare
< alt-svc: h3=":443"; ma=86400
< server-timing: cfExtPri

$ curl -v https://cloudflare-quic.com | head
* Established connection to cloudflare-quic.com (104.18.26.14 port 443) from 192.168.1.14 port 51077
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://cloudflare-quic.com/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: cloudflare-quic.com]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.16.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: cloudflare-quic.com
> User-Agent: curl/8.16.0
> Accept: */*
>
* Request completely sent off
< HTTP/2 200
< date: Wed, 08 Oct 2025 05:49:36 GMT
< content-type: text/html
< cf-ray: 98b35b21cc0ad76b-NRT
< server: cloudflare
< alt-svc: h3=":443"; ma=86400
<
{ [1360 bytes data]

$ curl --alt-svc altsvc.cache https://cloudflare-quic.com

# altsvc.cache というファイルに Alt-Svc の結果が格納されている.
$ cat altsvc.cache
# Your alt-svc cache. https://curl.se/docs/alt-svc.html
# This file was generated by libcurl! Edit at your own risk.
h2 cloudflare-quic.com 443 h3 cloudflare-quic.com 443 "20251009 06:44:24" 0 0

$ curl --alt-svc altsvc.cache -v https://cloudflare-quic.com
* Alt-svc connecting from [h2]cloudflare-quic.com:443 to [h3]cloudflare-quic.com:443
* Host cloudflare-quic.com:443 was resolved.
* IPv6: (none)
* IPv4: 104.18.26.14, 104.18.27.14
*   Trying 104.18.26.14:443...
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* SSL connection using TLSv1.3 / TLS_CHACHA20_POLY1305_SHA256 / [blank] / UNDEF
* Server certificate:
*  subject: CN=cloudflare-quic.com
*  start date: Oct  1 12:45:04 2025 GMT
*  expire date: Dec 30 13:45:01 2025 GMT
*  subjectAltName: host "cloudflare-quic.com" matched cert's "cloudflare-quic.com"
*  issuer: C=US; O=Google Trust Services; CN=WE1
*  SSL certificate verify ok.
*   Certificate level 0: Public key type ? (256/128 Bits/secBits), signed using ecdsa-with-SHA256
*   Certificate level 1: Public key type ? (256/128 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type ? (384/192 Bits/secBits), signed using ecdsa-with-SHA384
* Established connection to cloudflare-quic.com (104.18.26.14 port 443) from 192.168.1.14 port 58039
* using HTTP/3
* [HTTP/3] [0] OPENED stream for https://cloudflare-quic.com/
* [HTTP/3] [0] [:method: GET]
* [HTTP/3] [0] [:scheme: https]
* [HTTP/3] [0] [:authority: cloudflare-quic.com]
* [HTTP/3] [0] [:path: /]
* [HTTP/3] [0] [user-agent: curl/8.16.0]
* [HTTP/3] [0] [accept: */*]
* [HTTP/3] [0] [alt-used: cloudflare-quic.com:443]
> GET / HTTP/3
> Host: cloudflare-quic.com
> User-Agent: curl/8.16.0
> Accept: */*
> Alt-Used: cloudflare-quic.com:443
>
* Request completely sent off
< HTTP/3 200
< date: Wed, 08 Oct 2025 06:45:37 GMT
< content-type: text/html
< cf-ray: 98b3ad2bde7dd5ca-NRT
< priority: u=3,i=?0
< server: cloudflare
* Added alt-svc: cloudflare-quic.com:443 over h3
< alt-svc: h3=":443"; ma=86400
< server-timing: cfExtPri
<

$ mkdir letsencrypt
$ docker run -it \
  --rm \
  -v ./letsencrypt:/etc/letsencrypt \
  -e TZ="Asia/Tokyo" \
  certbot/certbot:latest \
  certonly \
  --manual \
  --preferred-challenges dns \
  -m メールアドレス \
  -d localhost.annpin.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for localhost.annpin.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:

_acme-challenge.localhost.annpin.com.

with the following value:

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.localhost.annpin.com.
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/localhost.annpin.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/localhost.annpin.com/privkey.pem
This certificate expires on 2026-01-06.
These files will be updated when the certificate renews.

NEXT STEPS:
- This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certifi
cate, repeat this same certbot command before the certificate's expiry date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

$ docker run -it nginx:1.29.2 /bin/sh

$ 2>&1 nginx -V | tr -- - '\n' | grep _module
http_addition_module
http_auth_request_module
http_dav_module
http_flv_module
http_gunzip_module
http_gzip_static_module
http_mp4_module
http_random_index_module
http_realip_module
http_secure_link_module
http_slice_module
http_ssl_module
http_stub_status_module
http_sub_module
http_v2_module
http_v3_module
mail_ssl_module
stream_realip_module
stream_ssl_module
stream_ssl_preread_module

services:
  nginx:
    image: nginx:1.29.2
    ports:
      - '443:443/udp'
      - '443:443/tcp'
    restart: always
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      # Let's Encrypt 証明書をマウント
      - ./letsencrypt/archive/localhost.annpin.com/fullchain1.pem:/etc/ssl/certs/server.crt    # サーバー証明書
      - ./letsencrypt/archive/localhost.annpin.com/privkey1.pem:/etc/ssl/certs/server.key      # 秘密鍵

worker_processes  1;

events {
  worker_connections  1024;
}

http {
  server {
    listen               443 ssl;            # Enable SSL
    listen               443 quic reuseport; # Enable QUIC and HTTP/3.
    # http2 on; をコメント化して無効化すれば HTTP/1.1 で接続を試し、 HTTP/3 に対応していれば HTTP/3 で通信するという振る舞いになる.
    http2                on;
    http3                on;
    add_header           Alt-Svc 'h3=":443"; ma=86400';    # 86400sec = 24hour

    server_name          localhost.annpin.com;
    ssl_protocols        TLSv1.2 TLSv1.3;    # TLSv1.3 is required for QUIC

    ssl_certificate      /etc/ssl/certs/server.crt;
    ssl_certificate_key  /etc/ssl/certs/server.key;

    # Just for testing
    access_log           /dev/stdout;
    error_log            /dev/stderr debug;

    location / {
      # Default page
      # 以下は指定すると HTTP/3 接続されなくなるようなので注意.
      # add_header X-Protocol $server_protocol always;
      root   /usr/share/nginx/html;
      index  index.html index.htm;
    }
  }
}