S. MORTALL.

tlshttp 18 Sep 2026 · 8 min read

Serving HTTP/3 without breaking HTTP/1.1 clients

Every few months I get asked to "turn on HTTP/3" on a server that is already serving traffic. The change looks trivial — enable QUIC, publish Alt-Svc, done — and it usually goes wrong in one of three ways. This is the checklist I ended up with.

1. UDP is not TCP, and middleboxes know it

If anything between the client and the server drops UDP/443, HTTP/3 will silently never be used: the browser tries QUIC, waits, and falls back to TCP. That is fine for users, but it means "HTTP/3 is enabled" can be true and never exercised. Verify with a client that speaks it explicitly, not with a browser:

curl --http3-only -sI https://example.com/

If that hangs and plain curl -sI works, the problem is the path, not the config.

2. The UDP receive buffer

QUIC needs a much larger socket buffer than most defaults allow. On Linux the relevant sysctls are net.core.rmem_max and net.core.wmem_max. With the default 208 KiB you will see throughput collapse under any real concurrency and blame the congestion controller.

sysctl -w net.core.rmem_max=16777216
sysctl -w net.core.wmem_max=16777216

3. Alt-Svc caching is aggressive

Once a browser sees Alt-Svc: h3=":443"; ma=86400, it will try QUIC for a day even if you turn it off. If you are rolling out on a server you cannot fully control, shorten ma during the trial. And remember that the header is per-origin: a redirect chain will not carry it.

What actually broke for me

The first rollout failed for a boring reason: the load balancer in front terminated TCP and had no UDP listener at all. Clients fell back cleanly, so nobody noticed for weeks — the only symptom was that the latency graphs never improved. After adding UDP to the balancer, the same clients started using h3 immediately, no client-side change.

Measuring "is the feature on" is not the same as measuring "is the feature used".

Fallback still matters

Keep HTTP/1.1 and HTTP/2 enabled on the same port via ALPN. A surprising number of corporate proxies still mangle the Upgrade-less h2 path, and some older clients only speak 1.1. There is no cost to offering all three; the negotiation sorts it out.


Discuss by email — address on the contact page.