Enabling HTTP/3 support on Windows Server 2022

Poor naming convention can be blamed for the misunderstandings with EnableAltSvc

This really should have been named EnableAltSvcFrame. How could one not see confusion arise from this when there is more than one form of altsvc?

On a side note, the HTTP team is slacking. Is anybody at MS managing these teams? So many changes in IIS with no updates on their blog

Edit: looks like QUIC on IIS is actually kind of broken. I noticed a LOT of QUIC errors appearing in the httperr log, so I ran a script like so on the server

:start
curl https://domain.tld -k --http3 --resolve domain.tld:443:127.0.0.1
goto start

The log FILLS with QUIC errors. this is reproducible on every IIS server I have access to

If you happen to get the error below...

I got this error after enabling EnableHttp3 in the registry at HKLM:\SYSTEM\CurrentControlSet\services\HTTP\Parameters and I did not have a TLS 1.3 cipher suite enabled.  I noticed that if I ran 

Enable-TlsCipherSuite -Name TLS_CHACHA20_POLY1305_SHA256 -Position 0

It actually did not get enabled.  Checking with

Get-TlsCipherSuite | Format-Table -Property CipherSuite, Name

showed it was still not enabled. I had to first...

From the Group Policy Management Console, go to Computer Configuration > Administrative Templates > Network > SSL Configuration Settings.

Double-click SSL Cipher Suite Order, and then click the Enabled option. Click Ok and then switch it back to Not Configured.  After doing that the Enable-TlsCipherSuite and Get-TlsCipherSuite commands worked correctly.  Once you reboot the original site binding error should go away.

Thank you to everyone for sharing their experiences. We will be publishing another post to help highlight some of the challenges each of you have run into. Please note (I need to write more about this) that the reg key enables the HTTP/3 altsvc frame; it does not add an HTTP response alt-svc header.

webwiz just so you know, msquic is on GitHub. I know the devs who run it and they would love to hear about this memory leak you're running into: https://github.com/microsoft/msquic/issues 

I have tried restarting the server, but I find it is the same on all our Windows Server 2022 web servers, the only way to get QUIC working in Chrome it sending the alt-svc: h3=":443"; header.

We are also having to disable QUIC in the IIS bindings on busy websites, or find that msquic.sys driver uses up all available server memory. It has a non-page memory leak that means it will suddenly gobble up 10 GB of memory. This can be after happen 20 minutes after a reboot or a few days. As it is kernel memory the only way to free it up is to reboot the server.

If you changed the settings on "Edit Site Binding" dialogue, you need to restart the OS(http.sys service).

I have tried setting EnableAltSvc registry and checking the "Require Server Name Indication" on "Edit Site Binding" dialogue and find that it doesn't work, at least not in Chrome, you still have to set the alt-svc: h3=":443"; header for Chrome to use QUIC. 

Set EnableAltSvc registry and check "Require Server Name Indication" on "Edit Site Binding" dialog. Browser will receive AltSvc HTTP/2 protocol message and try to connect over HTTP/3.

[Use ASP.NET Core with HTTP/3 on IIS]
https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/iis/http3?view=aspnetcore-6.0
IIS also supports sending an AltSvc HTTP/2 protocol message rather than a response header to notify the client that HTTP/3 is available.
See the EnableAltSvc registry key.
Note this requires netsh sslcert bindings that use host names rather than IP addresses.

By the way, I have written an HTTP / HTTPS Response Header Viewer at the link below which you can use to test what headers your website is sending which may be of use to you;

https://network-tools.webwiz.net/http-response-header-viewer.htm

You can use this to see if your website is sending the alt-svc: h3=":443"; header.

I have not tried the EnableAltSvc in the registry method so not sure what headers this would send to the browser.

Documentation from Mozilla and others I found indicated you need to send the following header which is working for me;

alt-svc: h3=":443"; 

I will test again, but it think the docs state that there are two methods: EnableAltSvc in registry does not seem enough? Or did I misread/misinterpret what is written?