Enable HTTP/3 on NGINX and Ubuntu 24.04: packages, config and verification with curl

Why distribution packages fall short

QUIC and HTTP/3 support in NGINX has been available since version 1.25.0 and is included in the official binary packages published by nginx.org. Those who install NGINX from Ubuntu's universe repository risk ending up with an older build lacking the ngx_http_v3_module: on an already-running production server, you check with nginx -v, and if the number is below 1.25.0 the module simply isn't there. The clean approach on Ubuntu 24.04 "noble" is to switch to the official nginx.org repository, which already compiles the v3 module into its distributed packages: if you're building from source instead, you must explicitly add the --with-http_v3_module flag during configure, because the module is not included by default.

Step 1: the official nginx.org repository

Ubuntu 24.04 "noble" is one of the versions officially supported by the nginx.org repository, both on x86_64 and aarch64/arm64. The commands, taken from the official Linux packages guide, are:

sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring

curl https://nginx.org/keys/nginx_signing.key \
 | gpg --dearmor \
 | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null

echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
https://nginx.org/packages/ubuntu $(lsb_release -cs) nginx" \
 | sudo tee /etc/apt/sources.list.d/nginx.list

sudo apt update
sudo apt install nginx

Those preferring the mainline version (more recent, the same branch that receives QUIC updates first) should replace the URL with https://nginx.org/packages/mainline/ubuntu.

Step 2: verify the module is actually there

Before touching the configuration, run a check:

nginx -V 2>&1 | grep -o with-http_v3_module

If the command returns nothing, the installed binary does not support HTTP/3 and no directive in nginx.conf will make it work: you need to change the package, not the configuration.

Step 3: directives in the server block

The main directives, documented in the ngx_http_v3_module, are the quic parameter on listen and, if using multiple workers, reuseport together with it. For dual addressing and compatibility with clients that don't yet support QUIC, nginx.org recommends using the same port for both HTTP/3 and HTTPS:

server {
 listen 443 ssl;
 listen 443 quic reuseport;
 listen [::]:443 ssl;
 listen [::]:443 quic reuseport;

 http2 on;
 http3 on;

 server_name example.com;

 ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
 ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 ssl_protocols TLSv1.3;

 add_header Alt-Svc 'h3=":443"; ma=86400' always;

 quic_retry on;
 ssl_early_data on;

 root /var/www/example.com;
 index index.html;
}

QUIC requires TLSv1.3 as mandatory, even though the TCP fallback connection continues to accept TLSv1.2. The http3 directive defaults to on in the http/server context once the module is compiled, but writing it explicitly makes the configuration clearer. quic_retry on enables address validation against amplification attacks; ssl_early_data on enables 0-RTT, but OpenSSL version 3.5.1 or higher is recommended for building NGINX with full QUIC support: below that threshold a compatibility layer is used which does not support 0-RTT.

After the change, test and reload:

sudo nginx -t
sudo systemctl reload nginx

Step 4: UDP port in the firewall

HTTP/3 travels over UDP, not TCP: the rule that server administrators forget most often is the UDP port one, because port 443 TCP has been open for HTTPS for ages. With ufw:

sudo ufw allow 443/tcp
sudo ufw allow 443/udp
sudo ufw reload

Without the UDP rule the browser tries HTTP/3, receives no response and falls back to HTTP/2 without visible errors: the site keeps working, but it's not using QUIC.

Step 5: verify with curl --http3

This is where you often stumble: the curl installed from apt on Ubuntu 24.04 normally doesn't support HTTP/3. According to curl.se's official documentation, support requires a build linked against ngtcp2 and nghttp3 together with a QUIC-compatible TLS library (OpenSSL 3.5.0 or higher, or BoringSSL, LibreSSL, quictls, or wolfSSL with QUIC patches). The check is done like this:

curl -V | grep -i HTTP3

If the feature line doesn't contain HTTP3, the binary needs to be replaced with a build that includes it before proceeding. Once you have a suitable curl, verify on the server:

curl --http3 -v https://example.com/

In the output, the initial response line should show the negotiated protocol version; with --http3-only the request fails explicitly if QUIC doesn't succeed, useful for a clean test without the automatic fallback to HTTP/2 or HTTP/1.1 that curl applies by default with --http3.

A security notice to know about

The QUIC module in NGINX remains experimental. CVE-2024-24989, which concerns the HTTP/3 QUIC module itself and can cause worker process termination in response to publicly undisclosed requests, is rated "Not affected" for the NGINX package on Ubuntu 24.04 LTS noble in the Ubuntu security advisory database — a good reason to nonetheless monitor security alerts when enabling a module labelled as experimental in production.

Requirements table

Component	Minimum version required	Where to verify
NGINX	1.25.0, with nginx.org package (v3 module pre-compiled) or custom build with --with-http_v3_module	nginx -V | grep http_v3_module
OpenSSL	1.1.1 or higher for basic QUIC; 3.5.1 or higher for 0-RTT (ssl_early_data)	openssl version
TLS in server block	TLSv1.3 mandatory	ssl_protocols directive
Ubuntu	24.04 "noble", officially supported platform by nginx.org packages	lsb_release -cs
curl for testing	build with ngtcp2 + nghttp3 and QUIC-compatible TLS	curl -V | grep HTTP3
Firewall	UDP port 443 open, alongside TCP 443	sudo ufw status