title: Enable HTTP2 on nginx
body: <p>I would like add HTTP2 support to my nginx server. I think all version is good, with <strong>http_v2_module</strong> :</p>
  
  <pre><code>nginx version: nginx/1.11.8
  built by gcc 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.3) 
  built with OpenSSL 1.0.1f 6 Jan 2014
  TLS SNI support enabled
  configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed'
  </code></pre>
  
  <p>I've edit my vhost and add http2 (<strong>listen 443 ssl http2;</strong>), restart nginx, but no result.</p>
  
  <p>My vhost config :</p>
  
  <pre><code>server {
    listen 80;
    listen [::]:80 ipv6only=on;
    server_name my-domaine.net;
    return 301 https://my-domaine.net$request_uri;
  }
  
  server {
    listen 80;
    server_name www.my-domaine.net;
    return 301 https://my-domaine.net$request_uri;
  }
  
  server {
    listen 80;
    server_name xx.xxx.xxx.xxx;
    return 301 https://my-domaine.net$request_uri;
  }
  
  server {
  
    listen 443 ssl http2;
  
    server_name my-domaine.net;
  
    access_log            /var/log/nginx/app.dev.access.log;
    error_log             /var/log/nginx/app.dev.error.log;
  
    ssl_certificate xxx;
    ssl_certificate_key xxx;
  
    ssl_session_timeout 1h;
    ssl_session_cache shared:SSL:16m;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.4.4 8.8.8.8 valid=300s;
    resolver_timeout 10s;
  
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA
  -AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE
  -RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:!RC
  4:!aNULL:!eNULL:!MD5:!EXPORT:!EXP:!LOW:!SEED:!CAMELLIA:!IDEA:!PSK:!SRP:!SSLv:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;
  
    ssl on;
  
    # Eviter de se faire piller son site (merci dsfc.net)
    add_header X-Robots-Tag "index,follow,noarchive";
    # HSTS permet de déclarer au client directement dans la réponse HTTP qu'il faut communiquer en HTTPS
    # Cette en-tête permet d'éviter le vol de cookies et le downgrade SSL
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    # Evite que le contenu soit interprété différemment que définit dans le mime Type
    add_header X-Content-Type-Options nosniff;
    # Protection contre le clickjacking
    add_header X-Frame-Options "SAMEORIGIN";
    # Protection contre les failles X-XSS
    add_header X-XSS-Protection "1; mode=block";
    # Faille spécifique à IE8
    add_header X-Download-Options noopen;
    # Interdire l'embarquement de tout ou partie de votre site dans un site ou logiciel tiers
    add_header X-Permitted-Cross-Domain-Policies none;
  
    location / {
      #try_files $uri @prerender;
      proxy_pass http://localhost:3000;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header X-Forwarded-For $remote_addr;
    }
  
    location ~ ^/(images|fonts)/.*.(png|jpg|svg|jpeg|ttf|otf|woff|woff2|eot)$ {
      root /opt/app/current/bundle/programs/web.browser/app;
      access_log off;
      expires max;
    }
  
    location ~ \.(css|html|ttf|otf|woff|woff2|eot)$ {
      root /opt/app/current/bundle/programs/web.browser;
      access_log off;
      expires max;
    }
  }
  </code></pre>
  
  <p>If i test the http2 support on <a href="https://tools.keycdn.com/http2-test" rel="nofollow noreferrer">this site</a>, i see http2 enabled. But on my browser networks, all request are http1 :/</p>
  
  <p>Anyone have idea ?</p>
  
  <p>Thank you !</p>