Sporadic slow HTTP3 loads, connection errors with HTTP3 on subdomains

AtmosphericIgnition · February 10, 2026, 8:25pm

My issues:

Enabling HTTP3/QUIC on my server causes long loading times (5000ms+ vs. ~30ms) and eventual fallback to HTTP2.
Enabling HTTP3/QUIC on subdomains results in HTTP 400 errors, and redirects to the apex domain.

How I encountered the problem:
I’m trying to enable HTTP3/QUIC on my webserver as a learning exercise. I started with selectively enabling HTTP3 on my main site, and didn’t have any issues, until enabling HTTP3 on one of my subdomains. The subdomain couldn’t be accessed over HTTP3 with either a web browser or curl, and eventually the subdomain seemingly started redirecting traffic to the apex domain. I’ve since disabled HTTP3 on my subdomains, but still have it enabled on the main site.

Solutions I’ve tried:
Updates, following NGINX Docs, following 3rd-party guides, only enabling HTTP3 on the main site.

Thank you for any suggestions or help.

Version of NGINX or NGINX adjacent software (e.g. NGINX Gateway Fabric):

nginx version: nginx/1.28.2
built with OpenSSL 3.6.1 27 Jan 2026
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --conf-path=/etc/nginx/nginx.conf --sbin-path=/usr/bin/nginx --modules-path=/usr/lib/nginx/modules --pid-path=/run/nginx.pid --lock-path=/run/lock/nginx.lock --user=http --group=http --http-log-path=/var/log/nginx/access.log --error-log-path=stderr --http-client-body-temp-path=/var/lib/nginx/client-body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-cc-opt='-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -g -ffile-prefix-map=/build/nginx/src=/usr/src/debug/nginx -flto=auto' --with-ld-opt='-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now -Wl,-z,pack-relative-relocs -flto=auto' --with-compat --with-debug --with-file-aio --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_degradation_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre-jit --with-stream=dynamic --with-stream_geoip_module=dynamic --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads

Deployment environment:
Arch Linux via Pacman on a VPS

Minimal NGINX config to reproduce your issue (preferably running on https://tech-playground.com/playgrounds/nginx for ease of debugging, and if not as a code block): (Tip → Run nginx -T to print your entire NGINX config to your terminal.)

worker_processes  1;

# Load all installed modules
include modules.d/*.conf;

events {
	worker_connections  1024;
}

http {
    include sites-enabled/*;
    include       mime.types;
    default_type  application/octet-stream;

    ## Use strong cipher setup
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256;
    ssl_conf_command Options PrioritizeChaCha;
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;

    resolver 127.0.0.53;

    # Clear unecessary information disclosure
    server_tokens off;
    more_clear_headers Server;
    more_clear_headers X-Powered-By;

    quic_host_key /etc/nginx/ssl/quic_host.key;
    http3_stream_buffer_size 1m;
    quic_retry on;
    ## TODO: Check NGINX docs on the danger of replay attacks
    # ssl_early_data on;

    ## TODO: Check if my setup supports Generic Segmentation Offloads for QUIC/UDP
    # quic_gso on;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    keepalive_timeout  65;

    types_hash_max_size 4096;
    types_hash_bucket_size 64;

    gzip  on;
    gzip_min_length 7680;
    gunzip on;

    brotli on;
    brotli_comp_level 5;
    brotli_min_length 7680;
    brotli_types text/plain text/css text/javascript application/javascript application/json image/svg+xml font/ttf;

    http2 on;

    log_format json_analytics escape=json '{'
                    '"msec": "$msec", ' # request unixtime in seconds with a milliseconds resolution
                    '"connection": "$connection", ' # connection serial number
                    '"connection_requests": "$connection_requests", ' # number of requests made in connection
                    '"pid": "$pid", ' # process pid
                    '"request_id": "$request_id", ' # the unique request id
                    '"request_length": "$request_length", ' # request length (including headers and body)
                    '"remote_addr": "$remote_addr", ' # client IP
                    '"remote_port": "$remote_port", ' # client port
                    '"time_local": "$time_local", '
                    '"time_iso8601": "$time_iso8601", ' # local time in the ISO 8601 standard format
                    '"request": "$request", ' # full path no arguments of the request
                    '"request_uri": "$request_uri", ' # full path and arguments if the request
                    '"args": "$args", ' # args
                    '"status": "$status", ' # response status code
                    '"body_bytes_sent": "$body_bytes_sent", ' # the number of body bytes exclude headers sent to a client
                    '"bytes_sent": "$bytes_sent", ' # the number of bytes sent to a client
                    '"http_referer": "$http_referer", ' # HTTP referer
                    '"http_user_agent": "$http_user_agent", ' # user agent
                    '"http_host": "$http_host", ' # the request Host: header
                    '"server_name": "$server_name", ' # the name of the vhost serving the request
                    '"request_time": "$request_time", ' # request processing time in seconds with msec resolution
                    '"upstream_connect_time": "$upstream_connect_time", ' # upstream handshake time incl. TLS
		    '"upstream_addr": "$upstream_addr", ' # upstream service address
                    '"ssl_protocol": "$ssl_protocol", ' # TLS protocol
                    '"ssl_cipher": "$ssl_cipher", ' # TLS cipher
		    '"ssl_curve": "$ssl_curve", ' # TLS KEX
                    '"scheme": "$scheme", ' # http or https
                    '"request_method": "$request_method", ' # request method
                    '"server_protocol": "$server_protocol", ' # request protocol
                    '}';

 	access_log /var/log/nginx/json_access.log json_analytics;

	error_log /var/log/nginx/log_error.log;
	error_log stderr emerg;

	#geoip_country /usr/share/GeoIP/GeoIP.dat;
	#geoip_city /usr/share/GeoIP/GeoIPCity.dat;

    server {
        listen 127.0.0.1:6767;
        location /nginx_status {
        stub_status;
        allow 127.0.0.1;   # only allow requests from localhost
        deny all;          # deny all other hosts
        	}
	location /json_access.log {
	root /var/log/nginx;
		}
	}


    server {
        listen       80;
        server_name  localhost;

        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }
}

Main site (apex domain):

server {
        listen 443 ssl;
	listen [::]:443 ssl;
	http3 on;
	listen 443 quic reuseport default_server;
	listen [::]:443 quic reuseport default_server;
        server_name prusa.net;

	include  /etc/nginx/snippets/custom-404.conf;

	ssl_certificate /etc/letsencrypt/live/prusa.net/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/prusa.net/privkey.pem;

	# Set webroot
	root /srv/prusa.net/public;
	index index.html;
	add_header alt-svc 'h3=":$server_port"; ma=3600';
	add_header x-quic 'h3';

	## WebSec headers
	include /etc/nginx/snippets/headers-minimal.conf;

	include /etc/nginx/snippets/block-ai-bots.conf;

	add_header referrer-policy "strict-origin-when-cross-origin" always;
	# CSP
	add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self'; media-src 'self'; font-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'none'; frame-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; base-uri 'self'; manifest-src 'self'; script-src-elem 'self' 'sha256-5GTl1LT/HgujxC+LNqqToWLC0q3W4RbxbGdKE3tU5zc=' 'sha256-f4NreiI8uGE1wdwjfXuMtccvVCHbEOiN1QK+y2uSlrg=' 'sha256-59WfUf1GrPHL/ehnyY3hEqIIn5x7GqeH9vD2RCbB5zE=' 'sha256-xhi6ptLg8dTM2XBtV/SYNxtnsQEnSv5wPm9wxHSlpUI='" always;
}

# HSTS forward
server {
	listen 80 default_server;
	listen [::]:80 default_server;

	return 301 https://$host$request_uri;
}

# Forward www to non-www
server {
	listen 443 ssl;
        listen [::]:443 ssl;
        server_name www.prusa.net;

	ssl_certificate /etc/letsencrypt/live/prusa.net/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/prusa.net/privkey.pem;

        return 301 $scheme://prusa.net$request_uri;
}

server {
	listen 443 ssl;
	listen [::]:443 ssl;
	server_name radek.prusa.net;

	ssl_certificate /etc/letsencrypt/live/prusa.net/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/prusa.net/privkey.pem;

	return 301 $scheme://prusa.net$request_uri;
}

Subdomain:

server {
        listen 443 ssl;
        listen [::]:443 ssl;
	http3 on;
	listen 443 quic;
	listen [::]:443 quic;
        server_name www.mon.prusa.net;

	ssl_certificate /etc/letsencrypt/live/mon.prusa.net/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mon.prusa.net/privkey.pem;

        return 301 $scheme://mon.prusa.net$request_uri;
}

# This is required to proxy Grafana Live WebSocket connections.
map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}

upstream grafana {
  server localhost:3000;
}


server {
	listen 443 ssl;
	listen [::]:443 ssl;
        server_name mon.prusa.net;

	ssl_certificate /etc/letsencrypt/live/mon.prusa.net/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mon.prusa.net/privkey.pem;

        ## WebSec
	include /etc/nginx/snippets/headers-minimal.conf;
	include /etc/nginx/snippets/unified-securitytxt.conf;
	include /etc/nginx/snippets/block-ai-bots.conf;

        add_header Referrer-Policy "no-referrer" always;
	proxy_hide_header X-Frame-Options;
	proxy_hide_header X-XSS-Protection;
	proxy_hide_header X-Content-Type-Options;

        # CSP
	# Grafana provides it's own CSP

	# Block crawlers and indexers
	add_header X-Robots-Tag "none" always;

       add_header alt-svc 'h3=":$server_port"; ma=3600';
       add_header x-quic 'h3';

  	location / {
   		proxy_set_header Host $host;
		proxy_pass http://grafana;
 	 }

 	# Proxy Grafana Live WebSocket connections.
	location /api/live/ {
    		proxy_http_version 1.1;
    		proxy_set_header Upgrade $http_upgrade;
    		proxy_set_header Connection $connection_upgrade;
    		proxy_set_header Host $host;
    		proxy_pass http://grafana;
	}
}

AtmosphericIgnition · February 15, 2026, 9:36pm

I have fixed the issue with my top level domain loading slow. The “fix” for serving a static site ended up being increasing my some of my kernel’s parameters to net.core.rmem_max = 7500000,net.core.wmem_max = 7500000,net.core.rmem_default = 7500000,net.core.wmem_default = 7500000 using sysctl. I’m still unsure that this is the real fix, because I have later gone and set the values back to their defaults, and the issue now doesn’t seem to occur even with the default kernel parameters.

The issue with my subdomains is likely (at least in part) related to what is described in this article: NGINX http3 http_host Is Empty — Here's the Fix [2026].

There are a couple possible solutions in works, and, at least some of them seem to be planned to become available in the next mainline release, or the impending 1.30 stable release.

github.com/nginx/nginx

Will not pass HTTP_HOST variable to fastcgi in HTTP3 request

opened 09:29AM - 14 Oct 24 UTC

closed 02:14PM - 24 Oct 24 UTC

Hill-98

question

### Environment Include the result of the following commands: - `nginx -V` ``…` nginx version: nginx/1.27.2 built by gcc 12.2.0 (Debian 12.2.0-14) built with LibreSSL 3.9.2 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --user=www-data --group=www-data --with-debug --with-http_ssl_module --with-http_v2_module --with-http_v3_module --with-openssl=../libressl-3.9.2 ``` - `uname -a` ``` Linux 46e409adba4b 5.15.153.1-microsoft-standard-WSL2 #1 SMP Fri Mar 29 23:14:13 UTC 2024 x86_64 GNU/Linux ``` ### Description When nginx handles HTTP3 requests, it does not pass the `HTTP_HOST` variable to PHP-FPM, and the debug log proves this. And this is the output of `phpinfo()`: https://gist.github.com/Hill-98/d621f559a894b63f8de8d18ea30383ce This is test command in `alpine/curl-http3`: `curl -H "Host: example.com" --http3 -k --resolve "example.com:443:127.0.0.1" https://example.com/phpinfo.php` - [x] The bug is reproducible with the latest version of nginx - [x] The nginx configuration is minimized to the smallest possible to reproduce the issue and doesn't contain third-party modules #### nginx configuration ``` user www-data www-data; error_log logs/error.log debug; events { use epoll; } http { access_log logs/access.log; http2 on; resolver 127.0.0.11; ssl_certificate certs/selfsigned.cert; ssl_certificate_key certs/selfsigned.key; ssl_dhparam certs/dhparam; server { listen 443 default_server ssl; listen 443 default_server quic reuseport; listen [::]:443 default_server ssl; listen [::]:443 default_server quic reuseport; return 444; } server { listen 443 quic; listen [::]:443 quic; listen 443 ssl; listen [::]:443 ssl; root /var/www/php; server_name example.com; location ~ [^/]\.php$ { fastcgi_param QUERY_STRING $query_string; fastcgi_param REQUEST_METHOD $request_method; fastcgi_param CONTENT_TYPE $content_type; fastcgi_param CONTENT_LENGTH $content_length; fastcgi_param SCRIPT_NAME $fastcgi_script_name; fastcgi_param REQUEST_URI $request_uri; fastcgi_param DOCUMENT_URI $document_uri; fastcgi_param DOCUMENT_ROOT $document_root; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param REQUEST_SCHEME $scheme; fastcgi_param HTTPS $https if_not_empty; fastcgi_param GATEWAY_INTERFACE CGI/1.1; fastcgi_param SERVER_SOFTWARE nginx; fastcgi_param REMOTE_ADDR $remote_addr; fastcgi_param REMOTE_PORT $remote_port; fastcgi_param SERVER_ADDR $server_addr; fastcgi_param SERVER_PORT $server_port; fastcgi_param SERVER_NAME $server_name; # PHP only, required if PHP was built with --enable-force-cgi-redirect fastcgi_param REDIRECT_STATUS 200; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_pass php-fpm:9000; } } } ``` #### nginx debug log [gist](https://gist.github.com/Hill-98/907b606b36c8c1f567ced36c4811958e)

Knowing this information, I have decided to wait until 1.30 is shipped before I try to use HTTP/3 with my reverse proxies again.

buulam · February 18, 2026, 6:44am

Thank you for the follow up @AtmosphericIgnition !

Topic		Replies	Views
Can't set up precompressed brotli or http3 NGINX ssl , config , web-server , http3	4	95	October 12, 2025
Proxy_params by default blocks reverse proxy for HTTP/3 NGINX reverse-proxy , quic , http3	5	188	October 3, 2025
HTTP/3 QUIC - Very poor throughput with high latency, high bandwidth connections NGINX quic , http3 , throughput , latency , bandwidth	10	1417	August 17, 2025
Debian 13 Nginx 1.29.3 add_header don't show up on html page NGINX http3	7	67	January 4, 2026
HTTP/2 and HTTP/3 on the same `server` NGINX web-server , http , http2 , http3	4	494	July 1, 2025

Sporadic slow HTTP3 loads, connection errors with HTTP3 on subdomains

Related topics