# SSL handshake didn't work same as http2 and http3

**URL:** <https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277>\
**Category:** NGINX\
**Tags:** ssl, quic, openresty, http3\
**Created:** [February 10, 2025, 10:03am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277 "2025-02-10T10:03:18Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![bit\_warrior](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/bit_warrior/32/257_2.png) [@bit\_warrior](https://community.nginx.org/u/bit_warrior)\
**Post date:** [February 10, 2025, 10:03am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/1 "2025-02-10T10:03:18Z")

</div>

**My issue** :  
Yield didn’t work fine on http3.

**How I encountered the problem** :  
If I use this command : `curl ` `https://example.mncdn.org:8443` it works fine.  
But if I tried `curl ` `https://example.mncdn.org:8443` ` --http3-only`, it didn’t work fine.

**Solutions I’ve tried** :

**My config** :  
daemon off;  
user root;  
worker\_processes 1;  
error\_log /dev/stdout debug;  
worker\_rlimit\_nofile 100000;  
master\_process off;  
error\_log logs/error.log debug;  
worker\_priority -10;

events {  
multi\_accept on;  
use epoll;  
worker\_connections 51202;  
}

thread\_pool default threads=32 max\_queue=65536;  
http {  
log\_format quic '$remote\_addr - $remote\_user [$time\_local] ’  
'“$request” $status $body\_bytes\_sent ’  
‘“$http\_referer” “$http\_user\_agent” “$http3”’;

```
access_log logs/access.log quic;

lua_package_path "$prefixlua/?.so;;$prefixlua/module/?.so;$prefixlua/?.lua;$prefixlua/module/?.lua;;";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;
ssl_prefer_server_ciphers on;

ssl_certificate certs/wildcard_mncdn_org.crt;
ssl_certificate_key certs/wildcard_mncdn_org.key;

server {
    listen 8443 ssl reuseport;
    listen 8443 quic reuseport;
    server_name example.mncdn.org;

    ssl_early_data on;

    http2 on;

    ssl_certificate_by_lua_block {
        local redis = require "resty.redis"
        local red, err = redis:new()
        if not red then
            ngx.log(ngx.ERR, "failed to instantiate redis: ", err)
            return
        end
        red:set_timeouts(1000, 1000, 1000)

        local ok, err = red:connect("127.0.0.1", 6379)
        if not ok then
            ngx.log(ngx.ERR, "failed to connect redis: ", err)
            return
        end

        local value, err = red:get("foo")
        if not value then
            ngx.log(ngx.ERR, "failed to get value", err)
            return
        end

        ngx.log(ngx.DEBUG, "The value is ", value)

        print("About to initiate a new SSL handshake!")
    }
    
    location / {
        add_header Alt-Svc 'h3=":$server_port"; ma=30, h3-29=":$server_port"; ma=30';
        return 200 'Hello, world!';
    }
}

```

}

---

<div class="post-metadata">

**Author:** ![Dylen](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/dylen/32/3_2.png) [@Dylen](https://community.nginx.org/u/Dylen)\
**Post date:** [February 10, 2025, 5:33pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/2 "2025-02-10T17:33:49Z")

</div>

Dropping this one in the troubleshooting category.

---

<div class="post-metadata">

**Author:** ![Damian\_Curry](https://avatars.discourse-cdn.com/v4/letter/d/94ad74/32.png) [@Damian\_Curry](https://community.nginx.org/u/Damian_Curry)\
**Post date:** [February 10, 2025, 6:14pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/3 "2025-02-10T18:14:28Z")

</div>

I think part of the issue here is that you can only use the `reuseport` flag once per server block. Can you try changing `listen 8443 ssl reuseport;` to `listen 8443 ssl;` and see if that solves the problem?

---

<div class="post-metadata">

**Author:** ![bit\_warrior](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/bit_warrior/32/257_2.png) [@bit\_warrior](https://community.nginx.org/u/bit_warrior)\
**Post date:** [February 11, 2025, 3:19am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/4 "2025-02-11T03:19:27Z")

</div>

Thank you @Damian_Curry  
I did it as you told me. But it’s not working too.  
Current issue occurs because of yield operation is not implemented correctly for http3.

---

<div class="post-metadata">

**Author:** ![Damian\_Curry](https://avatars.discourse-cdn.com/v4/letter/d/94ad74/32.png) [@Damian\_Curry](https://community.nginx.org/u/Damian_Curry)\
**Post date:** [February 11, 2025, 3:37pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/5 "2025-02-11T15:37:19Z")

</div>

Would it be possible to test this without the lua code? Also, which version of NGINX are you running? I am not seeing an include statement for the lua module, I assume you are testing using a openresty build. I am curious if you see the same behavior when testing with an official NGINX build.

---

<div class="post-metadata">

**Author:** ![bit\_warrior](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/bit_warrior/32/257_2.png) [@bit\_warrior](https://community.nginx.org/u/bit_warrior)\
**Post date:** [February 11, 2025, 10:41pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/6 "2025-02-11T22:41:54Z")

</div>

Yeah, I used openresty 1.25.3.1 version.  
But I am sure that in the official nginx version, this issue will occur too.

---

<div class="post-metadata">

**Author:** ![Damian\_Curry](https://avatars.discourse-cdn.com/v4/letter/d/94ad74/32.png) [@Damian\_Curry](https://community.nginx.org/u/Damian_Curry)\
**Post date:** [February 11, 2025, 11:13pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/7 "2025-02-11T23:13:49Z")

</div>

It might be worthwhile to test with the latest mainline version of nginx, as there have been some bug fixes related to http/3 in the newest builds.

---

<div class="post-metadata">

**Author:** ![bit\_warrior](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/bit_warrior/32/257_2.png) [@bit\_warrior](https://community.nginx.org/u/bit_warrior)\
**Post date:** [February 12, 2025, 7:03am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/8 "2025-02-12T07:03:13Z")

</div>

Thanks for your reply.  
But I think there should be a openssl patch file like openssl-1.1.1f-sess\_set\_get\_cb\_yield.patch

There is a patch file for yield, but it’s not working correctly on http3.  
So I want to the community fix current bug and provide a new patch file.  
Thanks

---

<div class="post-metadata">

**Author:** ![bit\_warrior](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/bit_warrior/32/257_2.png) [@bit\_warrior](https://community.nginx.org/u/bit_warrior)\
**Post date:** [February 28, 2025, 1:46am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/9 "2025-02-28T01:46:36Z")

</div>

I have finally fixed this issue.  
I made a sub module where do all redis operation.  
And called this API in the Lua phase.  
Thus, I didn’t use default asynchronous redis operation on the Lua phase.  
After that, this config works fine.

But pathing the nginx with new yield operation would be good solution.  
Thank you for your considering my issue.

---

<div class="post-metadata">

**Author:** ![furqanhamid](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/furqanhamid/32/811_2.png) [@furqanhamid](https://community.nginx.org/u/furqanhamid)\
**Post date:** [March 15, 2025, 11:09am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/10 "2025-03-15T11:09:29Z")

</div>

> [@bit\_warrior](#):
>
> **My issue** :  
> Yield didn’t work fine on http3.
> 
> **How I encountered the problem** :  
> If I use this command : `curl ` `https://example.mncdn.org:8443` it works fine.  
> But if I tried `curl ` `https://example.mncdn.org:8443` ` --http3-only`, it didn’t work fine.
> 
> **Solutions I’ve tried** :
> 
> **My config** :  
> daemon off;  
> user root;  
> worker\_processes 1;  
> error\_log /dev/stdout debug;  
> worker\_rlimit\_nofile 100000;  
> master\_process off;  
> error\_log logs/error.log debug;  
> worker\_priority -10;
> 
> events {  
> multi\_accept on;  
> use epoll;  
> worker\_connections 51202;  
> }
> 
> thread\_pool default threads=32 max\_queue=65536;  
> http {  
> log\_format quic '$remote\_addr - $remote\_user [$time\_local] ’  
> '“$request” $status $body\_bytes\_sent ’  
> ‘“$http\_referer” “$http\_user\_agent” “$http3”’;
> 
> ```auto
> access_log logs/access.log quic;
> 
> lua_package_path "$prefixlua/?.so;;$prefixlua/module/?.so;$prefixlua/?.lua;$prefixlua/module/?.lua;;";
> ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
> ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;
> ssl_prefer_server_ciphers on;
> 
> ssl_certificate certs/wildcard_mncdn_org.crt;
> ssl_certificate_key certs/wildcard_mncdn_org.key;
> 
> server {
> listen 8443 ssl reuseport;
> listen 8443 quic reuseport;
> server_name example.mncdn.org;
> 
> ssl_early_data on;
> 
> http2 on;
> 
> ssl_certificate_by_lua_block {
> local redis = require "resty.redis"
> local red, err = redis:new()
> if not red then
> ngx.log(ngx.ERR, "failed to instantiate redis: ", err)
> return
> end
> red:set_timeouts(1000, 1000, 1000)
> 
> local ok, err = red:connect("127.0.0.1", 6379)
> if not ok then
> ngx.log(ngx.ERR, "failed to connect redis: ", err)
> return
> end
> 
> local value, err = red:get("foo")
> if not value then
> ngx.log(ngx.ERR, "failed to get value", err)
> return
> end
> 
> ngx.log(ngx.DEBUG, "The value is ", value)
> 
> print("About to initiate a new SSL handshake!")
> }
>     
> location / {
> add_header Alt-Svc 'h3=":$server_port"; ma=30, h3-29=":$server_port"; ma=30';
> return 200 'Hello, world!';
> }
> }
> 
> ```

It looks like HTTP/3 isn’t working due to an SSL handshake issue. Try checking if your OpenSSL and Nginx versions support QUIC properly, and ensure your firewall allows UDP traffic on port 8443. Also, verify that your ssl\_certificate and ssl\_certificate\_key are correctly configured for QUIC.

---

<div class="post-metadata">

**Author:** ![bit\_warrior](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/bit_warrior/32/257_2.png) [@bit\_warrior](https://community.nginx.org/u/bit_warrior)\
**Post date:** [March 17, 2025, 6:42am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/11 "2025-03-17T06:42:52Z")

</div>

Thank you @furqanhamid  
I have set all configures correctly.  
Current issue just for not correctly implemented for yield operation in Openresty/Nginx. I already described the solution in the above comment.  
If you need I can provide you whole solutions.  
But nginx still need patch for yeild operation for HTTP3.

---

<div class="post-metadata">

**Author:** ![furqanhamid](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/furqanhamid/32/811_2.png) [@furqanhamid](https://community.nginx.org/u/furqanhamid)\
**Post date:** [March 20, 2025, 9:19am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/12 "2025-03-20T09:19:53Z")

</div>

Thanks mate! I would love to read more about http3 yield operation. Hopefully, in near future!

---

<div class="post-metadata">

**Author:** ![Damian\_Curry](https://avatars.discourse-cdn.com/v4/letter/d/94ad74/32.png) [@Damian\_Curry](https://community.nginx.org/u/Damian_Curry)\
**Post date:** [April 10, 2025, 12:20am UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/15 "2025-04-10T00:20:17Z")

</div>

If you would like to discuss the implementation of the yield operation in NGINX I would recommend opening an issue in the [NGINX GitHub repo](https://github.com/nginx/nginx/issues).

---

<div class="post-metadata">

**Author:** ![furqanhamid](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/furqanhamid/32/811_2.png) [@furqanhamid](https://community.nginx.org/u/furqanhamid)\
**Post date:** [June 19, 2025, 2:22pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/17 "2025-06-19T14:22:13Z")

</div>

> [@furqanhamid](#):
>
> OpenSSL and N

Okay thanks for your response. I have faced the same issue with [Honos | T-RANKS](http://bit.ly/4ejIGks). That went so bad that this cast us 2 weeks in settling those issues.

---

<div class="post-metadata">

**Author:** ![bit\_warrior](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/bit_warrior/32/257_2.png) [@bit\_warrior](https://community.nginx.org/u/bit_warrior)\
**Post date:** [June 27, 2025, 12:45pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/18 "2025-06-27T12:45:35Z")

</div>

Thanks to a contributor, I could find a solution in GitHub.

> <https://github.com/openresty/openresty/pull/1058>
>
> I hereby granted the copyright of the changes in this pull request
> to the autho…rs of this openresty project.

---

<div class="post-metadata">

**Author:** ![alessandro](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/alessandro/32/4836_2.png) [@alessandro](https://community.nginx.org/u/alessandro)\
**Post date:** [June 27, 2025, 1:00pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/19 "2025-06-27T13:00:22Z")

</div>

Nice! It’s probably worth noting that OpenResty uses NGINX but we do not support at all their version of NGINX. I also double checked and we actually have had this fix for a long time on our mainline build, so it might be worth testing it out if you run into a similar issue in the future. I’m glad you found a solution though!

---

<div class="post-metadata">

**Author:** ![system](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/system/32/19_2.png) [@system](https://community.nginx.org/u/system)\
**Post date:** [July 4, 2025, 1:00pm UTC](https://community.nginx.org/t/ssl-handshake-didnt-work-same-as-http2-and-http3/277/20 "2025-07-04T13:00:49Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.