All Products
Search

This Product

    Alibaba Cloud Service Mesh:Nonaktifkan HTTP/2 untuk HTTPS pada gerbang masuk

    Document Center

    Alibaba Cloud Service Mesh:Nonaktifkan HTTP/2 untuk HTTPS pada gerbang masuk

    Last Updated:Aug 30, 2026

    Jika klien Anda mengalami masalah dengan HTTP/2 melalui HTTPS dan Anda tidak dapat dengan mudah mengubah konfigurasinya, nonaktifkan protokol HTTP/2 pada gerbang Alibaba Cloud Service Mesh (ASM). Topik ini menjelaskan cara menonaktifkan HTTP/2 untuk HTTPS pada gerbang masuk.

    Prasyarat

    Langkah 1: Verifikasi konfigurasi default

    Untuk memverifikasi bahwa Application-Layer Protocol Negotiation (ALPN) secara default menggunakan HTTP/2, jalankan perintah berikut untuk mengakses gerbang ASM. Ganti <INGRESS_GATEWAY_IP> dengan alamat IP gerbang masuk Anda.

    curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:<INGRESS_GATEWAY_IP>  https://b.aliyun.com/status/418 -v

    Output yang diharapkan:

    * Added b.aliyun.com:443:8.217.xxx xxx to DNS cache
* Hostname b.aliyun.com was found in DNS cache
*   Trying 8.217.xxx xxx:443...
* Connected to b.aliyun.com (8.217.xxx xxx) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=aliyun.com; O=myexample organization
*  start date: Apr 10 08:23:54 2023 GMT
*  expire date: Apr  9 08:23:54 2024 GMT
*  issuer: O=myexample Inc.; CN=aliyun.com
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* h2 [:method: HEAD]
* h2 [:scheme: https]
* h2 [:authority: b.aliyun.com]
* h2 [:path: /status/418]
* h2 [user-agent: curl/8.1.2]
* h2 [accept: */*]
* Using Stream ID: 1 (easy handle 0x12e80d600)
> HEAD /status/418 HTTP/2
> Host:b.aliyun.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/2 418
HTTP/2 418
< server: istio-envoy
server: istio-envoy
< date: Thu, 14 Sep 2023 08:23:25 GMT
date: Thu, 14 Sep 2023 08:23:25 GMT
< access-control-allow-origin: *
access-control-allow-origin: *
< x-more-info: http://tools.ietf.org/html/rfc2324
x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-credentials: true
access-control-allow-credentials: true
< content-length: 135
content-length: 135
< x-envoy-upstream-service-time: 5
x-envoy-upstream-service-time: 5

    Output tersebut menunjukkan bahwa klien menawarkan HTTP/2 dan HTTP/1.1 dalam daftar ALPN. Secara default, gerbang lebih memilih HTTP/2.

    Langkah 2: Nonaktifkan HTTP/2 untuk HTTPS

    1. Masuk ke Konsol ASM. Di panel navigasi kiri, pilih Service Mesh > Mesh Management.

    2. Pada halaman Mesh Management, klik nama instans ASM. Di panel navigasi kiri, pilih ASM Gateways > Ingress Gateway.

    3. Pada halaman Ingress Gateway, temukan gerbang yang ingin Anda konfigurasi, lalu klik View YAML di kolom Actions. Pada kotak dialog Edit, tambahkan konfigurasi podAnnotations di bawah bidang spec, lalu klik OK.

      podAnnotations:
    proxy.istio.io/config: |
      httpsHttp2Disabled: true
      Catatan

      Konfigurasi ini menyebabkan gerbang melakukan restart.

    Langkah 3: Verifikasi bahwa HTTP/2 telah dinonaktifkan untuk HTTPS

    Jalankan kembali perintah berikut untuk mengakses gerbang ASM. Ganti <INGRESS_GATEWAY_IP> dengan alamat IP gerbang masuk Anda.

    curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:<INGRESS_GATEWAY_IP>  https://b.aliyun.com/status/418 -v

    Output yang diharapkan:

    * Added b.aliyun.com:443:8.217.xxx.xxx  to DNS cache
* Hostname b.aliyun.com was found in DNS cache
*   Trying 8.217.xxx.xxx:443...
* Connected to b.aliyun.com (8.217.xxx.xxx) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*   subject: CN=aliyun.com; O=myexample organization
*   start date: Apr 10 08:23:54 2023 GMT
*   expire date: Apr  9 08:23:54 2024 GMT
*   issuer: O=myexample Inc.; CN=aliyun.com
*   SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/1.1
> HEAD /status/418 HTTP/1.1
> Host:b.aliyun.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 418 Unknown
HTTP/1.1 418 Unknown
< server: istio-envoy
server: istio-envoy
< date: Thu, 14 Sep 2023 08:20:13 GMT
date: Thu, 14 Sep 2023 08:20:13 GMT
< access-control-allow-origin: *
access-control-allow-origin: *
< x-more-info: http://tools.ietf.org/html/rfc2324
x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-credentials: true
access-control-allow-credentials: true
< content-length: 135
content-length: 135
< x-envoy-upstream-service-time: 1
x-envoy-upstream-service-time: 1

    Output tersebut menunjukkan bahwa protokol ALPN yang diterima oleh server adalah HTTP/1.1. Hal ini mengonfirmasi bahwa HTTP/2 telah dinonaktifkan.