cis-nginx-v300-4-1-12

CIS 4.1.12 — Ensure HTTP/3.0 is used

Profile Applicability

• Level 2 - Webserver

Description

HTTP/2 is the established standard for web communication, offering significant performance benefits over HTTP/1.1 through multiplexing. For 2025 and beyond, HTTP/3 should also be enabled. HTTP/3 operates over the QUIC protocol, which is built on UDP, to solve head-of-line blocking, reduce connection setup time, and improve performance on unreliable networks. Both protocols require a secure TLS 1.3 environment to function.

Rationale

Enabling HTTP/2 provides a baseline of modern performance via stream multiplexing. Enabling HTTP/3 provides a further competitive advantage by mitigating TCP's head-of-line blocking and offering a faster, more reliable connection handshake, which is especially beneficial for mobile users. A server supporting both protocols can serve the vast majority of modern clients with the best possible performance and security. The strong encryption requirements of both protocols naturally align with a TLS 1.3-only policy.

Impact

HTTP/2 has no significant negative impact as it is universally supported by modern clients. Enabling HTTP/3 has operational considerations:

1. NGINX Build: Your NGINX binary must be compiled with HTTP/3 and QUIC support. Standard OS packages may not include this. The repository of NGINX itself has the http_v3 module since NGINX version 1.25.0

   Run this command and check if the http_v3 module is present:

   nginx -V 2>&1 | tr ' ' '\n' | grep --color=auto 'with-'
   

2. Firewall Configuration: You must allow UDP traffic on port 443, as HTTP/3 uses the QUIC protocol over UDP. This is a common oversight that will cause HTTP/3 to fail.

Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration:

nginx -T 2>/dev/null | grep -E '^\s*(listen|add_header.*Alt-Svc)'

Verify the following in the output for your primary server block:

1. The TCP listen directive includes the http2 parameter: listen 443 ssl http2;
2. A UDP listen directive with the quic parameter exists: listen 443 quic reuseport;
3. An Alt-Svc header is being sent to advertise HTTP/3 availability: add_header Alt-Svc 'h3=":443"; ma=63072000';

If any of these are missing, this recommendation is not fully implemented.

Remediation

Prerequisite: Ensure your NGINX version is compiled with the --with-http_v3_module flag.

1. Open your NGINX server configuration file.
2. In the main server block for your HTTPS site, add or modify the directives to enable HTTP/2, HTTP/3, and advertise its availability.
3. Ensure your firewall allows UDP traffic on port 443.

server {
    # 1. Enable HTTP/2 on the standard TCP listener
    listen          443       ssl http2;
    listen          [::]:443 ssl http2;

    # 2. Enable HTTP/3 on the UDP listener
    listen          443       quic reuseport;
    listen          [::]:443 quic reuseport;

    # ... other ssl directives like ssl_certificate ...

    # 3. Advertise HTTP/3 availability to browsers
    # The max-age (ma) is in seconds (e.g., 2 years)
    add_header      Alt-Svc 'h3=":443"; ma=63072000';

    # Required for HTTP/3
    ssl_early_data  on;
}

Default Value

By default, NGINX only enables HTTP/1.1. HTTP/2 and HTTP/3 must be explicitly configured.

References

1. https://nginx.org/en/docs/http/ngx_http_v3_module.html
2. https://datatracker.ietf.org/doc/html/rfc9114
3. https://nginx.org/en/docs/http/ngx_http_v2_module.html

CIS Controls

MITRE ATT&CK Mappings

Profile

• Level 2 - Webserver