http3/quic环境搭建

1，确保系统为centos，yum在线安装nginx-quic命令如下

yum install epel-release
yum install centos-release-scl
yum install yum-plugin-copr
yum copr enable ryoh/nginx-quic
yum install nginx-quic

2，配置nginx.conf

include conf.modules.d/*.conf;
 
user       nginx;
pid        /var/run/nginx.pid;
error_log  /var/log/nginx/error.log;
 
worker_processes       auto;
worker_rlimit_nofile   4096;
 
events {
    worker_connections 1024;
    accept_mutex_delay 100ms;
    multi_accept       on;
    use                epoll;
}
 
http {
    access_log /var/log/nginx/access.log;
    server {
        listen 80;
        listen 443 ssl http2;
        listen 443 http3 reuseport;
        server_name quictest.net;
 
        #以下为TLS配置
        ssl_protocols TLSv1.3;
        ssl_ecdh_curve X25519:P-256:P-384;
        ssl_ciphers TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:EECDH+CHACHA20:EECDH+AES128;
 
        ssl_certificate     /etc/nginx/cert/quictest.net.cn.cert.pem;
        ssl_certificate_key /etc/nginx/cert/quictest.net.key.pem;
 
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
 
        # 该选项用于开启address validation，但是会和下方的0-RTT冲突
        #quic_retry on;
 
        # 开启 TLS 1.3 0-RTT
        ssl_early_data on;
        # 添加 Early-Data 头告知后端, 防止重放攻击
        proxy_set_header Early-Data $ssl_early_data;
 
        # 参考nginx官方目前支持的http3版本，我们添加对应的header
        add_header Alt-Svc 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"';
}
}

注：免费ssl申请金额参考https://www.jianshu.com/p/4fc32ccecb5b

重启nginx-quic

systemctl restart nginx

3，用chrome浏览器访问https://quictest.net
需要chrome浏览器添加quic支持及白名单
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --no-proxy-server --enable-quic --quic-host-whitelist="quictest.net" --origin-to-force-quic-on=quictest.net:443
设置完即可通过chrome访问quic部署的网站

4，http3/quic测试网站
https://www.http3check.net/