All Products
Search

This Product

    Alibaba Cloud Service Mesh:Disable HTTP/2 for HTTPS on an ingress gateway

    Document Center

    Alibaba Cloud Service Mesh:Disable HTTP/2 for HTTPS on an ingress gateway

    Last Updated:Aug 29, 2026

    If your client has issues with HTTP/2 over HTTPS and you cannot easily modify its configuration, disable the HTTP/2 protocol on the Alibaba Cloud Service Mesh (ASM) gateway. This topic describes how to disable HTTP/2 for HTTPS on an ingress gateway.

    Prerequisites

    Step 1: Verify the default configuration

    To verify that Application-Layer Protocol Negotiation (ALPN) defaults to HTTP/2, run the following command to access the ASM gateway. Replace <INGRESS_GATEWAY_IP> with the IP address of your ingress gateway.

    curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:<INGRESS_GATEWAY_IP>  https://b.aliyun.com/status/418 -v

    Expected output:

    * Added b.aliyun.com:443:8.217.xxx xxx to DNS cache
* Hostname b.aliyun.com was found in DNS cache
*   Trying 8.217.xxx xxx:443...
* Connected to b.aliyun.com (8.217.xxx xxx) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=aliyun.com; O=myexample organization
*  start date: Apr 10 08:23:54 2023 GMT
*  expire date: Apr  9 08:23:54 2024 GMT
*  issuer: O=myexample Inc.; CN=aliyun.com
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* h2 [:method: HEAD]
* h2 [:scheme: https]
* h2 [:authority: b.aliyun.com]
* h2 [:path: /status/418]
* h2 [user-agent: curl/8.1.2]
* h2 [accept: */*]
* Using Stream ID: 1 (easy handle 0x12e80d600)
> HEAD /status/418 HTTP/2
> Host:b.aliyun.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/2 418
HTTP/2 418
< server: istio-envoy
server: istio-envoy
< date: Thu, 14 Sep 2023 08:23:25 GMT
date: Thu, 14 Sep 2023 08:23:25 GMT
< access-control-allow-origin: *
access-control-allow-origin: *
< x-more-info: http://tools.ietf.org/html/rfc2324
x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-credentials: true
access-control-allow-credentials: true
< content-length: 135
content-length: 135
< x-envoy-upstream-service-time: 5
x-envoy-upstream-service-time: 5

    The output shows that the client offers both HTTP/2 and HTTP/1.1 in the ALPN list. By default, the gateway prefers HTTP/2.

    Step 2: Disable HTTP/2 for HTTPS

    1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

    2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.

    3. On the Ingress Gateway page, find the gateway that you want to configure and click View YAML in the Actions column. In the Edit dialog box, add the podAnnotations configuration under the spec field, and then click OK.

      podAnnotations:
    proxy.istio.io/config: |
      httpsHttp2Disabled: true
      Note

      This configuration causes the gateway to restart.

    Step 3: Verify that HTTP/2 is disabled for HTTPS

    Run the following command again to access the ASM gateway. Replace <INGRESS_GATEWAY_IP> with the IP address of your ingress gateway.

    curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:<INGRESS_GATEWAY_IP>  https://b.aliyun.com/status/418 -v

    Expected output:

    * Added b.aliyun.com:443:8.217.xxx.xxx  to DNS cache
* Hostname b.aliyun.com was found in DNS cache
*   Trying 8.217.xxx.xxx:443...
* Connected to b.aliyun.com (8.217.xxx.xxx) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*   subject: CN=aliyun.com; O=myexample organization
*   start date: Apr 10 08:23:54 2023 GMT
*   expire date: Apr  9 08:23:54 2024 GMT
*   issuer: O=myexample Inc.; CN=aliyun.com
*   SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/1.1
> HEAD /status/418 HTTP/1.1
> Host:b.aliyun.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 418 Unknown
HTTP/1.1 418 Unknown
< server: istio-envoy
server: istio-envoy
< date: Thu, 14 Sep 2023 08:20:13 GMT
date: Thu, 14 Sep 2023 08:20:13 GMT
< access-control-allow-origin: *
access-control-allow-origin: *
< x-more-info: http://tools.ietf.org/html/rfc2324
x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-credentials: true
access-control-allow-credentials: true
< content-length: 135
content-length: 135
< x-envoy-upstream-service-time: 1
x-envoy-upstream-service-time: 1

    The output shows that the ALPN protocol accepted by the server is HTTP/1.1. This confirms that HTTP/2 is disabled.