HTTP/2 for backend connections - Global Accelerator - Alibaba Cloud Documentation Center

If you use Global Accelerator for your HTTPS service, you can enable HTTP/2 for connections to your backend services. This allows you to use HTTP/2 features to improve performance, reduce latency, and lower network overhead.

What is HTTP/2

HTTP/2, also known as HTTP 2.0, builds on HTTP/1.1 with new features like multiplexing, header compression, request prioritization, and server push. These features resolve long-standing issues in HTTP/1.1, optimizing request performance while remaining compatible with its semantics. Modern browsers such as Chrome, Edge, Safari, and Firefox all support HTTP/2.

Advantages of HTTP/2:

Binary protocol: Unlike the text-based parsing of HTTP/1.x, HTTP/2 splits all transmitted information into smaller, binary-encoded messages and frames. The binary format provides greater extensibility, such as allowing frames to carry data and instructions.
Multiplexing: In HTTP/1.x, performance optimizations often involved techniques like image sprites and using multiple domains because browsers limit the number of concurrent requests to a single domain. When a page required many resources, head-of-line blocking would cause new requests to wait for others to complete. In HTTP/2, the binary framing layer allows multiple requests and responses to be sent concurrently over a shared TCP connection. They are reassembled at the other end using stream identifiers and headers. This technique avoids the head-of-line blocking issue of older HTTP versions and greatly improves transmission performance.
Header compression: HTTP request headers contain a large amount of information that is sent repeatedly with each request. HTTP/2 uses the HPACK format for compression. Both the client and server maintain a cached table of header fields, and only the index of a known header is sent, improving efficiency and speed.

HTTP/2 negotiation

For HTTPS connections, the client and server must establish a Transport Layer Security (TLS) connection before sending application data. To support HTTP/2, the handshake uses Application-Layer Protocol Negotiation (ALPN) to determine which protocol version to use.

When you enable HTTP/2 in Global Accelerator, it specifies h2 in the ALPN field of the ClientHello message during the TLS handshake. Global Accelerator then ignores the protocol version returned by the server in the ServerHello message, forcing an HTTP/2 connection to the backend service.

Use case

This topic uses the following scenario. A company is headquartered in the US (Silicon Valley) and hosts its HTTPS website on Alibaba Cloud ECS instances. Most of its clients are located in China (Hong Kong). The company uses Global Accelerator to mitigate network issues such as latency, jitter, and packet loss caused by unstable cross-border public networks.

To further improve website performance and user experience, the company plans to adopt the HTTP/2 protocol.

By default, when Global Accelerator is configured with HTTPS as the backend service protocol, it connects to backend services using HTTP/1.1. The company now needs to modify its Global Accelerator instance configuration to specify HTTP/2 for backend connections to take full advantage of the protocol's performance improvements.

Limitations

The following limitations apply when you configure Global Accelerator to use HTTP/2 to connect to backend services:

If the Protocol Version option is not available for your Global Accelerator instance, your instance may not support this feature. To enable it, contact your account manager to upgrade your instance.
The WebSocket protocol is not supported.
The Server Push feature of HTTP/2 is not supported.
gRPC requests that are based on HTTP/2 cannot be accelerated.

Prerequisites

Purchase or upload a server certificate in the Certificate Management Service console. For more information, see Purchase an official certificate and Upload, sync, and share SSL certificates.
Upload the certificate files to your backend server. For more information, see Use Cloud Assistant to upload a file to an ECS instance.

Your backend server has an HTTPS service deployed on port 443 with the HTTP/2 protocol version enabled.

Make sure you have added a rule to allow inbound traffic on TCP port 443 in the backend server's security group. For more information, see Add a security group rule.

Example: Configure an HTTPS service on port 443 and enable HTTP/2 in Nginx on an Alibaba Cloud ECS instance

Run the following commands to install Nginx and deploy a sample test application.

yum install -y nginx
cd /usr/share/nginx/html/
echo "Hello World ! This is ECS." > index.html

Run the following command to create a directory for the certificate and private key.
```
mkdir -p /etc/pki/nginx/private/
```

Run the following commandto edit the Nginx configuration file nginx.conf, modify the protocol version configuration, and then save and exit.

vim /etc/nginx/nginx.conf

Use the following configuration:

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
events {
    worker_connections 1024;
}
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" "$server_protocol"';
    access_log  /var/log/nginx/access.log  main;
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    server {
        # Enable the HTTP/2 protocol version.
        listen       443 ssl http2;
        listen       [::]:443 ssl http2;
        server_name  _;
        root         /usr/share/nginx/html;
        # Enter the path to your certificate file.
        ssl_certificate "/etc/pki/nginx/<cert-file-name>.pem";
        # Enter the path to your certificate private key file.
        ssl_certificate_key "/etc/pki/nginx/private/<cert-file-name>.key";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers PROFILE=SYSTEM;
        ssl_prefer_server_ciphers on;
        error_page 404 /404.html;
            location = /40x.html {
        }
        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }
}

Run the following command to restart the Nginx service.
```
systemctl restart nginx.service
```

Create a Global Accelerator instance, add the backend server as an endpoint, and set the backend service protocol to HTTPS. For more information, see Create and manage standard Global Accelerator instances.
Ensure your domain is mapped to the CNAME address assigned by the Global Accelerator instance. For more information, see Add a CNAME record.

Configure HTTP/2 for backend connections

This section describes only the key configuration items relevant to this scenario. For more information about endpoint group settings, see Add and manage endpoint groups for intelligent-routing listeners.

Log on to the GA console.
On the Instances page, find the GA instance that you want to manage and click Configure Listener in the Actions column.
On the Listeners tab, find the target listener, and then click Modify Endpoint Group in the Actions column.
In the Configure Listener & Protocol step of the wizard, click Next.
In the Configure Endpoint Group step of the wizard, set IP Version to HTTP/2, and then click Next.

Set Backend Service Protocol to HTTPS and Protocol Version to HTTP/2.
In the Configuration Review step, confirm the configuration and click Submit.

Verify the results

To verify that HTTP/2 is enabled, perform the following steps before and after you change the protocol version.

From a client in the China (Hong Kong) region, open a browser and enter https://<accelerated domain name>. You should be able to access the backend service normally.

On the backend server in the US (Silicon Valley) region, open a command-line window and run the following command to view the most recent access record.

The access record shows the protocol version used to forward the request to the backend server.

tail -n 1 /var/log/nginx/access.log

Before you configure the protocol version, the access log shows that the back-to-origin request uses the HTTP/1.1 protocol.

[root@iZxxx ~]# tail -n 1 /var/log/nginx/access.log
172.20.xxx - - [30/Jul/2024:14:40:40 +0800] "GET / HTTP/1.1" 200 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0 Safari/537.36 Edg/126.0.0.0" "47.76.xxx"

After you configure the protocol version to HTTP/2, the access log shows that the back-to-origin request uses HTTP/2.0.

[root@iZrj95wxxx xxx  ~]# tail -n 1 /var/log/nginx/access.log
172.20.xxx.xxx - - [30/Jul/2024:14:42:55 +0800] "GET / HTTP/2.0" 200 27 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0 Safari/537.36 Edg/126.0.0" "47.76.xxx.xxx"

Tutorials

For detailed information about endpoint group settings, see Add and manage endpoint groups for intelligent-routing listeners.
To upgrade client-facing connections to HTTP/3, set the maximum HTTP version for client-to-Global-Accelerator access to HTTP/3. For more information, see Use HTTP/3 to improve the access experience of your applications.

API reference

CreateEndpointGroup: Creates an endpoint group. Use the EndpointProtocolVersion parameter to specify the protocol version for connecting to backend services.
UpdateEndpointGroup: Modifies the business configuration of an endpoint group. Use the EndpointProtocolVersion parameter to specify the protocol version for connecting to backend services.
DeleteEndpointGroup: Deletes an endpoint group.

Global Accelerator:HTTP/2 for backend connections