# Sporadic slow HTTP3 loads, connection errors with HTTP3 on subdomains **URL:** \ **Category:** NGINX\ **Tags:** reverse-proxy, web-server\ **Created:** [February 10, 2026, 8:25pm UTC](https://community.nginx.org/t/sporadic-slow-http3-loads-connection-errors-with-http3-on-subdomains/8998 "2026-02-10T20:25:56Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![AtmosphericIgnition](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@AtmosphericIgnition](https://community.nginx.org/u/AtmosphericIgnition)\ **Post date:** [February 10, 2026, 8:25pm UTC](https://community.nginx.org/t/sporadic-slow-http3-loads-connection-errors-with-http3-on-subdomains/8998/1 "2026-02-10T20:25:56Z")
**My issues:** 1. Enabling HTTP3/QUIC on my server causes long loading times (5000ms+ vs. ~30ms) and eventual fallback to HTTP2. 2. Enabling HTTP3/QUIC on subdomains results in HTTP 400 errors, and redirects to the apex domain. **How I encountered the problem:** I’m trying to enable HTTP3/QUIC on my webserver as a learning exercise. I started with selectively enabling HTTP3 on my main site, and didn’t have any issues, until enabling HTTP3 on one of my subdomains. The subdomain couldn’t be accessed over HTTP3 with either a web browser or curl, and eventually the subdomain seemingly started redirecting traffic to the apex domain. I’ve since disabled HTTP3 on my subdomains, but still have it enabled on the main site. **Solutions I’ve tried:** Updates, following NGINX Docs, following 3rd-party guides, only enabling HTTP3 on the main site. Thank you for any suggestions or help. **Version of NGINX or NGINX adjacent software (e.g. NGINX Gateway Fabric):** ```auto nginx version: nginx/1.28.2 built with OpenSSL 3.6.1 27 Jan 2026 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --conf-path=/etc/nginx/nginx.conf --sbin-path=/usr/bin/nginx --modules-path=/usr/lib/nginx/modules --pid-path=/run/nginx.pid --lock-path=/run/lock/nginx.lock --user=http --group=http --http-log-path=/var/log/nginx/access.log --error-log-path=stderr --http-client-body-temp-path=/var/lib/nginx/client-body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-cc-opt='-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -g -ffile-prefix-map=/build/nginx/src=/usr/src/debug/nginx -flto=auto' --with-ld-opt='-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now -Wl,-z,pack-relative-relocs -flto=auto' --with-compat --with-debug --with-file-aio --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_degradation_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre-jit --with-stream=dynamic --with-stream_geoip_module=dynamic --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads ``` **Deployment environment:** Arch Linux via Pacman on a VPS **Minimal NGINX config to reproduce your issue (preferably running on [https://tech-playground.com/playgrounds/nginx](https://tech-playground.com/playgrounds/nginx) for ease of debugging, and if not as a code block):** _(Tip → Run `nginx -T` to print your entire NGINX config to your terminal.)_ ```auto worker_processes 1; # Load all installed modules include modules.d/*.conf; events { worker_connections 1024; } http { include sites-enabled/*; include mime.types; default_type application/octet-stream; ## Use strong cipher setup ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256; ssl_conf_command Options PrioritizeChaCha; ssl_protocols TLSv1.3 TLSv1.2; ssl_prefer_server_ciphers on; ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; resolver 127.0.0.53; # Clear unecessary information disclosure server_tokens off; more_clear_headers Server; more_clear_headers X-Powered-By; quic_host_key /etc/nginx/ssl/quic_host.key; http3_stream_buffer_size 1m; quic_retry on; ## TODO: Check NGINX docs on the danger of replay attacks # ssl_early_data on; ## TODO: Check if my setup supports Generic Segmentation Offloads for QUIC/UDP # quic_gso on; #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' # '$status $body_bytes_sent "$http_referer" ' # '"$http_user_agent" "$http_x_forwarded_for"'; #access_log logs/access.log main; sendfile on; keepalive_timeout 65; types_hash_max_size 4096; types_hash_bucket_size 64; gzip on; gzip_min_length 7680; gunzip on; brotli on; brotli_comp_level 5; brotli_min_length 7680; brotli_types text/plain text/css text/javascript application/javascript application/json image/svg+xml font/ttf; http2 on; log_format json_analytics escape=json '{' '"msec": "$msec", ' # request unixtime in seconds with a milliseconds resolution '"connection": "$connection", ' # connection serial number '"connection_requests": "$connection_requests", ' # number of requests made in connection '"pid": "$pid", ' # process pid '"request_id": "$request_id", ' # the unique request id '"request_length": "$request_length", ' # request length (including headers and body) '"remote_addr": "$remote_addr", ' # client IP '"remote_port": "$remote_port", ' # client port '"time_local": "$time_local", ' '"time_iso8601": "$time_iso8601", ' # local time in the ISO 8601 standard format '"request": "$request", ' # full path no arguments of the request '"request_uri": "$request_uri", ' # full path and arguments if the request '"args": "$args", ' # args '"status": "$status", ' # response status code '"body_bytes_sent": "$body_bytes_sent", ' # the number of body bytes exclude headers sent to a client '"bytes_sent": "$bytes_sent", ' # the number of bytes sent to a client '"http_referer": "$http_referer", ' # HTTP referer '"http_user_agent": "$http_user_agent", ' # user agent '"http_host": "$http_host", ' # the request Host: header '"server_name": "$server_name", ' # the name of the vhost serving the request '"request_time": "$request_time", ' # request processing time in seconds with msec resolution '"upstream_connect_time": "$upstream_connect_time", ' # upstream handshake time incl. TLS '"upstream_addr": "$upstream_addr", ' # upstream service address '"ssl_protocol": "$ssl_protocol", ' # TLS protocol '"ssl_cipher": "$ssl_cipher", ' # TLS cipher '"ssl_curve": "$ssl_curve", ' # TLS KEX '"scheme": "$scheme", ' # http or https '"request_method": "$request_method", ' # request method '"server_protocol": "$server_protocol", ' # request protocol '}'; access_log /var/log/nginx/json_access.log json_analytics; error_log /var/log/nginx/log_error.log; error_log stderr emerg; #geoip_country /usr/share/GeoIP/GeoIP.dat; #geoip_city /usr/share/GeoIP/GeoIPCity.dat; server { listen 127.0.0.1:6767; location /nginx_status { stub_status; allow 127.0.0.1; # only allow requests from localhost deny all; # deny all other hosts } location /json_access.log { root /var/log/nginx; } } server { listen 80; server_name localhost; location / { root /usr/share/nginx/html; index index.html index.htm; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } } } ``` Main site (apex domain): ```auto server { listen 443 ssl; listen [::]:443 ssl; http3 on; listen 443 quic reuseport default_server; listen [::]:443 quic reuseport default_server; server_name prusa.net; include /etc/nginx/snippets/custom-404.conf; ssl_certificate /etc/letsencrypt/live/prusa.net/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/prusa.net/privkey.pem; # Set webroot root /srv/prusa.net/public; index index.html; add_header alt-svc 'h3=":$server_port"; ma=3600'; add_header x-quic 'h3'; ## WebSec headers include /etc/nginx/snippets/headers-minimal.conf; include /etc/nginx/snippets/block-ai-bots.conf; add_header referrer-policy "strict-origin-when-cross-origin" always; # CSP add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self'; media-src 'self'; font-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'none'; frame-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; base-uri 'self'; manifest-src 'self'; script-src-elem 'self' 'sha256-5GTl1LT/HgujxC+LNqqToWLC0q3W4RbxbGdKE3tU5zc=' 'sha256-f4NreiI8uGE1wdwjfXuMtccvVCHbEOiN1QK+y2uSlrg=' 'sha256-59WfUf1GrPHL/ehnyY3hEqIIn5x7GqeH9vD2RCbB5zE=' 'sha256-xhi6ptLg8dTM2XBtV/SYNxtnsQEnSv5wPm9wxHSlpUI='" always; } # HSTS forward server { listen 80 default_server; listen [::]:80 default_server; return 301 https://$host$request_uri; } # Forward www to non-www server { listen 443 ssl; listen [::]:443 ssl; server_name www.prusa.net; ssl_certificate /etc/letsencrypt/live/prusa.net/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/prusa.net/privkey.pem; return 301 $scheme://prusa.net$request_uri; } server { listen 443 ssl; listen [::]:443 ssl; server_name radek.prusa.net; ssl_certificate /etc/letsencrypt/live/prusa.net/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/prusa.net/privkey.pem; return 301 $scheme://prusa.net$request_uri; } ``` Subdomain: ```auto server { listen 443 ssl; listen [::]:443 ssl; http3 on; listen 443 quic; listen [::]:443 quic; server_name www.mon.prusa.net; ssl_certificate /etc/letsencrypt/live/mon.prusa.net/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/mon.prusa.net/privkey.pem; return 301 $scheme://mon.prusa.net$request_uri; } # This is required to proxy Grafana Live WebSocket connections. map $http_upgrade $connection_upgrade { default upgrade; '' close; } upstream grafana { server localhost:3000; } server { listen 443 ssl; listen [::]:443 ssl; server_name mon.prusa.net; ssl_certificate /etc/letsencrypt/live/mon.prusa.net/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/mon.prusa.net/privkey.pem; ## WebSec include /etc/nginx/snippets/headers-minimal.conf; include /etc/nginx/snippets/unified-securitytxt.conf; include /etc/nginx/snippets/block-ai-bots.conf; add_header Referrer-Policy "no-referrer" always; proxy_hide_header X-Frame-Options; proxy_hide_header X-XSS-Protection; proxy_hide_header X-Content-Type-Options; # CSP # Grafana provides it's own CSP # Block crawlers and indexers add_header X-Robots-Tag "none" always; add_header alt-svc 'h3=":$server_port"; ma=3600'; add_header x-quic 'h3'; location / { proxy_set_header Host $host; proxy_pass http://grafana; } # Proxy Grafana Live WebSocket connections. location /api/live/ { proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_pass http://grafana; } } ``` ---
**Author:** ![AtmosphericIgnition](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@AtmosphericIgnition](https://community.nginx.org/u/AtmosphericIgnition)\ **Post date:** [February 15, 2026, 9:36pm UTC](https://community.nginx.org/t/sporadic-slow-http3-loads-connection-errors-with-http3-on-subdomains/8998/2 "2026-02-15T21:36:42Z")
I have fixed the issue with my top level domain loading slow. The “fix” for serving a static site ended up being increasing my some of my kernel’s parameters to `net.core.rmem_max = 7500000`,`net.core.wmem_max = 7500000`,`net.core.rmem_default = 7500000`,`net.core.wmem_default = 7500000` using sysctl. I’m still unsure that this is the real fix, because I have later gone and set the values back to their defaults, and the issue now doesn’t seem to occur even with the default kernel parameters. The issue with my subdomains is likely (at least in part) related to what is described in this article: [NGINX http3 http\_host Is Empty — Here's the Fix [2026]](https://www.getpagespeed.com/server-setup/nginx/nginx-http3-http_host-fix). There are a couple possible solutions in works, and, at least some of them seem to be planned to become available in the next mainline release, or the impending 1.30 stable release. > > > \### Environment > > Include the result of the following commands: > - \`nginx -V\` > \`\`…\` > nginx version: nginx/1.27.2 > built by gcc 12.2.0 (Debian 12.2.0-14) > built with LibreSSL 3.9.2 > TLS SNI support enabled > configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --user=www-data --group=www-data --with-debug --with-http\_ssl\_module --with-http\_v2\_module --with-http\_v3\_module --with-openssl=../libressl-3.9.2 > \`\`\` > - \`uname -a\` > \`\`\` > Linux 46e409adba4b 5.15.153.1-microsoft-standard-WSL2 #1 SMP Fri Mar 29 23:14:13 UTC 2024 x86\_64 GNU/Linux > \`\`\` > > \### Description > > When nginx handles HTTP3 requests, it does not pass the \`HTTP\_HOST\` variable to PHP-FPM, and the debug log proves this. > > And this is the output of \`phpinfo()\`: https://gist.github.com/Hill-98/d621f559a894b63f8de8d18ea30383ce > > This is test command in \`alpine/curl-http3\`: \`curl -H "Host: example.com" --http3 -k --resolve "example.com:443:127.0.0.1" https://example.com/phpinfo.php\` > > \- \[x\] The bug is reproducible with the latest version of nginx > \- \[x\] The nginx configuration is minimized to the smallest possible > to reproduce the issue and doesn't contain third-party modules > > \#### nginx configuration > > \`\`\` > user www-data www-data; > error\_log logs/error.log debug; > > events { > use epoll; > } > > http { > access\_log logs/access.log; > http2 on; > resolver 127.0.0.11; > ssl\_certificate certs/selfsigned.cert; > ssl\_certificate\_key certs/selfsigned.key; > ssl\_dhparam certs/dhparam; > > server { > listen 443 default\_server ssl; > listen 443 default\_server quic reuseport; > listen \[::\]:443 default\_server ssl; > listen \[::\]:443 default\_server quic reuseport; > > return 444; > } > > server { > listen 443 quic; > listen \[::\]:443 quic; > listen 443 ssl; > listen \[::\]:443 ssl; > > root /var/www/php; > server\_name example.com; > > location ~ \[^/\]\\.php$ { > fastcgi\_param QUERY\_STRING $query\_string; > fastcgi\_param REQUEST\_METHOD $request\_method; > fastcgi\_param CONTENT\_TYPE $content\_type; > fastcgi\_param CONTENT\_LENGTH $content\_length; > > fastcgi\_param SCRIPT\_NAME $fastcgi\_script\_name; > fastcgi\_param REQUEST\_URI $request\_uri; > fastcgi\_param DOCUMENT\_URI $document\_uri; > fastcgi\_param DOCUMENT\_ROOT $document\_root; > fastcgi\_param SERVER\_PROTOCOL $server\_protocol; > fastcgi\_param REQUEST\_SCHEME $scheme; > fastcgi\_param HTTPS $https if\_not\_empty; > > fastcgi\_param GATEWAY\_INTERFACE CGI/1.1; > fastcgi\_param SERVER\_SOFTWARE nginx; > > fastcgi\_param REMOTE\_ADDR $remote\_addr; > fastcgi\_param REMOTE\_PORT $remote\_port; > fastcgi\_param SERVER\_ADDR $server\_addr; > fastcgi\_param SERVER\_PORT $server\_port; > fastcgi\_param SERVER\_NAME $server\_name; > > # PHP only, required if PHP was built with --enable-force-cgi-redirect > fastcgi\_param REDIRECT\_STATUS 200; > > fastcgi\_param SCRIPT\_FILENAME $document\_root$fastcgi\_script\_name; > fastcgi\_pass php-fpm:9000; > } > } > } > > \`\`\` > > \#### nginx debug log > > \[gist\](https://gist.github.com/Hill-98/907b606b36c8c1f567ced36c4811958e) > > > \### Proposed changes > > This removes a large amount of duplicated code, and repl…aces less-tested code specific to HTTP/3 with more-tested code used by HTTP/2. As a result, the behaviors of HTTP/2 and HTTP/3 are now more consistent with each other. > > Fixes #587 > Fixes #256 > Fixes #187 > Fixes #598 > Fixes #612 > > > This set of commits adds a new default value for $http\_host for the FastCGI, SCG…I & uwsgi modules, which will be based on the HTTP HOST request header or :authority pseudo-header field accordingly. Knowing this information, I have decided to wait until 1.30 is shipped before I try to use HTTP/3 with my reverse proxies again. ---
**Author:** ![buulam](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/buulam/32/3733_2.png) [@buulam](https://community.nginx.org/u/buulam)\ **Post date:** [February 18, 2026, 6:44am UTC](https://community.nginx.org/t/sporadic-slow-http3-loads-connection-errors-with-http3-on-subdomains/8998/3 "2026-02-18T06:44:49Z")
Thank you for the follow up @AtmosphericIgnition ! 👏 ---
**Author:** ![system](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/system/32/19_2.png) [@system](https://community.nginx.org/u/system)\ **Post date:** [February 25, 2026, 6:45am UTC](https://community.nginx.org/t/sporadic-slow-http3-loads-connection-errors-with-http3-on-subdomains/8998/4 "2026-02-25T06:45:15Z")
Closed on February 25, 2026, 6:45am UTC This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.