Configure HTTP/2 in Different Application Engines

HTTP/2 is a modern binary duplex multiplexing protocol designed as a replacement for HTTP/1.x.

Jetty, Netty, and Tomcat engines provide HTTP/2 implementations that Ktor can use. However, there are significant differences,and each engine requires additional configuration. Once your host is configured properly for Ktor, HTTP/2 support will be activated automatically.

Key requirements:

  • SSL certificate (can be self-signed)
  • ALPN implementation suitable for a particular engine (see corresponding sections for Netty, Jetty, and Tomcat)
  • HTTP/2 compliant browsers (all major browsers have supported it since the end of 2015 according to caniuse.com)

SSL certificate

As per the specification, HTTP/2 does not require encryption, but all browsers will require encrypted connections to be used with HTTP/2.That’s why a working TLS environment is a prerequisite for enabling HTTP/2. Therefore, a certificate is required to enable encryption.For testing purposes, it can be generated with keytool from the JDK:

  1. keytool -keystore test.jks -genkeypair -alias testkey -keyalg RSA -keysize 4096 -validity 5000 -dname 'CN=localhost, OU=ktor, O=ktor, L=Unspecified, ST=Unspecified, C=US'

The next step is configuring Ktor to use your keystore. See the example application.conf:

application.conf

  1. ktor {
  2.     deployment {
  3.         port = 8080
  4.         sslPort = 8443
  5.         watch = [ ]
  6.     }
  8.     application {
  9.         modules = [ com.example.ModuleKt.main ]
  10.     }
  12.     security {
  13.         ssl {
  14.             keyStore = /path/to/test.jks
  15.             keyAlias = testkey
  16.             keyStorePassword = changeit
  17.             privateKeyPassword = changeit
  18.         }
  19.     }
  20. }

ALPN implementation

HTTP/2 requires ALPN (Application-Layer Protocol Negotiation) to be enabled.Unfortunately, the JDK’s TLS implementation doesn’t have support for ALPN, so your application engine must be configured properly. The first option is to use an external ALPN implementation that needs to be added to the boot classpath.Another option is to use OpenSSL native bindings and precompiled native binaries. Both approaches are error-prone and require extra attention when being configured.Also, each particular engine can support only one of these methods.

Jetty

Jetty supports the JDK ALPN extension, and to get it working you have to add an extra-dependency to the java boot classpath.It is very important to add it to the boot classpath, as adding it to a regular classpath doesn’t work.

The other issue is that the exact dependency version depends on the JDK version. For example, for JDK 8u144, alpn boot 8.1.11.v20170118should be used (see https://www.eclipse.org/jetty/documentation/9.4.x/alpn-chapter.html#alpn-versions for the full compatibility list).

The following JVM options should be applied (the path can be relative):

  1. -Xbootclasspath/p:/path/to/alpn-boot-8.1.11.v20170118.jar

Depending on your build system you will probably need to copy the dependency to some specific directory. In Maven you could use maven-dependency-plugin (goal copy-dependencies) or Copy task in Gradle.

  1. <build>
  2.     <plugins>
  3.         <plugin>
  4.             <artifactId>maven-dependency-plugin</artifactId>
  5.             <executions>
  6.                 <execution>
  7.                     <id>unpack-jetty-alpn</id>
  8.                     <goals>
  9.                         <goal>copy-dependencies</goal>
  10.                     </goals>
  11.                     <phase>compile</phase>
  12.                     <configuration>
  13.                         <includeArtifactIds>alpn-boot</includeArtifactIds>
  14.                         <stripVersion>true</stripVersion>
  15.                     </configuration>
  16.                 </execution>
  17.             </executions>
  18.         </plugin>
  19.     </plugins>
  20. </build>

If all of the above is done properly, Jetty will log that ssl, alpn, and h2 are enabled:

  1. INFO  org.eclipse.jetty.server.Server - jetty-9.4.6.v20170531
  2. INFO  o.e.jetty.server.AbstractConnector - Started ServerConnector@337762cd{HTTP/1.1,[http/1.1, h2c]}{0.0.0.0:8080}
  3. INFO  o.e.jetty.util.ssl.SslContextFactory - x509=X509@433defed(testkey,h=[],w=[]) for SslContextFactory@2a693f59(null,null)
  4. INFO  o.e.jetty.server.AbstractConnector - Started ServerConnector@49c90a9c{SSL,[ssl, alpn, h2, http/1.1]}{0.0.0.0:8443}
  5. INFO  org.eclipse.jetty.server.Server - Started @1619ms

Netty

The easiest way to enable HTTP/2 in Netty is to use OpenSSL bindings (tcnative netty port). Add an API jar to dependencies:

  1. <dependency>
  2.     <groupId>io.netty</groupId>
  3.     <artifactId>netty-tcnative</artifactId>
  4.     <version>${tcnative.version}</version>
  5. </dependency>

and then native implementation (statically linked BoringSSL library, a fork of OpenSSL):

  1.     <dependency>
  2.         <groupId>io.netty</groupId>
  3.         <artifactId>netty-tcnative-boringssl-static</artifactId>
  4.         <version>${tcnative.version}</version>
  5.     </dependency>
  7.     <dependency>
  8.         <groupId>io.netty</groupId>
  9.         <artifactId>netty-tcnative-boringssl-static</artifactId>
  10.         <version>${tcnative.version}</version>
  11.         <classifier>${tc.native.classifier}</classifier>
  12.     </dependency>

where tc.native.classifier should be one of the following: linux-x86_64, osx-x86_64 or windows-x86_64.

Once all dependencies have been provided, Ktor will enable HTTP/2 support on the SSL port.

Tomcat and other servlet containers

Similar to Netty, to get HTTP/2 working in Tomcat you need native OpenSSL bindings. Unfortunately, Tomcat’s tcnative is not completely compatible with the Netty one.This is why you need a slightly different binary. You can get it here (https://tomcat.apache.org/native-doc/), or you can try Netty’s tcnative. However,you’ll have to guess which exact version is compatible with your specific Tomcat version.

If you are deploying your Ktor application as a war package into the server (servlet container), then you will have to configure your Tomcat server properly: