How to enable HTTP/3 with Nginx?

[Pieter]

I'm having trouble enabling HTTP/3 with Nginx.

Have compiled Nginx with the "--with-http_v3_module" \
Config located here:
/usr/local/directadmin/custombuild/custom/nginx/configure.nginx

Have tried the the following in my template:

# 1st attempt (not sure how to enable for IPv6):

listen |IP|:|PORT_443| ssl;
listen |IP|:|PORT_443| quic reuseport;
http2 on;
|MULTI_IP|

# 2nd attempt (hardcoding my IPs)

listen 1.234.567.89:443 ssl;
listen [2001:123:aaa:456:0:0:0:1]:443 ssl;
http2 on;
listen 1.234.567.89:443 quic reuseport;
listen [2001:123:aaa:456:0:0:0:1]:443 quic reuseport;

Added the header:

add_header Alt-Svc 'h3=":443"; ma=86400';

Config located here:
/usr/local/directadmin/data/templates/custom/nginx_server_secure.conf

Using (https://http3check.net/):
HTTP over TCP request to server failed, forcing my ipv4 results in QUIC is supported & HTTP/3 is supported

Using SSL Labs I get various warnings: 'Failed to communicate with the secure server' & 'Unexpected failure : No supported protocol found' & 'Unexpected failure'.

Reverting to my original nginx_server_secure.conf listening block:

listen |IP|:|PORT_443| ssl;
http2 on;
|MULTI_IP|

brings back my A+ score on SSL Labs


Am I missing something?

 

[zEitEr]

Hello,

Does nginx restart at all after the modification? Can you access the sites from the server?

Am I missing something?

 

[Pieter]

Yes, everything rewrites and starts correctly.

Just started with a bare minimum nginx_server_secure.conf template and a single html file.

Noticed that the actual order of the listed directives make a difference.

listen 1.234.567.89:443 quic reuseport;
listen [2001:123:aaa:456:0:0:0:1]:443 quic reuseport;
http2 on;
listen 1.234.567.89:443 ssl;
listen [2001:123:aaa:456:0:0:0:1]:443 ssl;

Adding the Mozilla Intermediate SSL config to my nginx_server_secure.conf fixes some connections issues but this could be a coincidence.

Still I get random 'Server closed connection' issues with SSL Labs Handshake Simulation

 

[Pieter]

Checking my Nginx error_log after the SSL Labs 'Server closed connection' issues:

2025/11/08 17:13:33 [alert] 466747#0: worker process 466748 exited on signal 11 (core dumped)
2025/11/08 17:13:39 [alert] 466747#0: worker process 466881 exited on signal 11 (core dumped)
2025/11/08 17:14:14 [alert] 466747#0: worker process 466888 exited on signal 11 (core dumped)free(): invalid next size (normal)
2025/11/08 17:14:17 [alert] 466747#0: worker process 466963 exited on signal 6 (core dumped)
2025/11/08 17:14:19 [alert] 466747#0: worker process 467001 exited on signal 11 (core dumped)
2025/11/08 17:14:20 [alert] 466747#0: worker process 467014 exited on signal 11 (core dumped)
2025/11/08 17:14:21 [alert] 466747#0: worker process 467029 exited on signal 11 (core dumped)
2025/11/08 17:14:22 [alert] 466747#0: worker process 467036 exited on signal 11 (core dumped)
2025/11/08 17:14:24 [alert] 466747#0: worker process 467044 exited on signal 11 (core dumped)
2025/11/08 17:14:25 [alert] 466747#0: worker process 467053 exited on signal 11 (core dumped)
2025/11/08 17:14:30 [alert] 466747#0: worker process 467069 exited on signal 11 (core dumped)
2025/11/08 17:14:31 [alert] 466747#0: worker process 467079 exited on signal 11 (core dumped)
2025/11/08 17:14:32 [alert] 466747#0: worker process 467086 exited on signal 11 (core dumped)

 

[Pieter]

Downgrading to nginx/1.29.1 fixed the issue for now.

Tried nginx/1.29.3 but the issues re-appears, disabling all custom modules in configure.nginx (while keeping http_v3_module) makes no difference.

Probably related (nginx/1.29.2 + http/3 + worker process exited on signal 11):

https://www.reddit.com/r/nginx/comments/1o20rih/psa_1292_debian_12_bookworm_worker_thread_crashes