Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
FREEDOM251

Freedom251 › Blog › Apache

How to Enable HTTP/2 in Apache on Ubuntu

By Freedom251 Team · · 8 min read

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

On an up-to-date Ubuntu server, enable Apache’s HTTP/2 module with sudo a2enmod http2, then add Protocols h2 http/1.1 inside the site’s HTTPS <VirtualHost *:443> block. Validate the configuration, reload Apache, and confirm negotiation with an HTTP/2-capable client such as curl.

What you are enabling

Apache implements HTTP/2 through mod_http2. Enabling the module makes Apache understand the HTTP/2 protocol, but the module alone does not make every virtual host serve HTTP/2. The Protocols directive determines which protocol names Apache offers and where that policy applies.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For a normal public website, the interoperable configuration is HTTP/2 over TLS. In Apache syntax, h2 means HTTP/2 over HTTPS, while http/1.1 keeps the older protocol available for clients that cannot negotiate HTTP/2. The usual directive is:

Protocols h2 http/1.1

Browsers normally negotiate h2 during the TLS handshake with ALPN. A browser that cannot use HTTP/2 can still connect through HTTP/1.1 when that protocol is listed as a fallback.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Check the server before changing Apache

Use a supported, updated Ubuntu installation

Check the Ubuntu release and the installed Apache package before enabling the module. Apache documents mod_http2 compatibility from Apache HTTP Server 2.4.17 onward, but the package supplied by a particular Ubuntu release and its security-update state still matter. Historical Ubuntu advisories include release and package combinations in which mod_http2 was unavailable or affected by denial-of-service issues.

Apply the current security updates appropriate for your Ubuntu release before exposing HTTP/2 publicly. If the host is running an old, unsupported release, upgrading it is safer than enabling an old module build simply because the configuration directive is available.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Identify the TLS virtual host that actually serves the site

HTTP/2 for a browser-facing site requires HTTPS. Find the active Apache virtual host for the hostname and confirm that it listens on port 443, has the intended certificate, and serves the expected document root. The relevant configuration is normally a block shaped like this:

<VirtualHost *:443>
    ServerName example.com
    # certificate, key, document root, and other existing directives
</VirtualHost>

Do not assume that the first SSL-looking file you find is the active site. Apache can have several HTTPS virtual hosts, and a request may be routed to a different block because of its hostname. Enabling HTTP/2 in the wrong block can leave the intended site on HTTP/1.1 or change the behavior of another hostname.

Confirm TLS is already working

Ubuntu’s Apache setup uses mod_ssl and an SSL virtual-host configuration for HTTPS. HTTP/2 negotiation depends on a successful TLS connection and ALPN. If the site has a certificate error, an incomplete TLS virtual host, or a policy that prevents a client from negotiating HTTP/2, enabling mod_http2 will not fix those problems.

Enable HTTP/2 step by step

1. Enable Apache’s HTTP/2 module

Run:

sudo a2enmod http2

Ubuntu’s a2enmod utility enables a module by creating links in /etc/apache2/mods-enabled. A module may have both a .load file and a .conf file, so the command manages the module’s complete enablement rather than asking you to edit those links manually.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

The command may report that the module is already enabled. That is not an error; continue by checking the virtual-host directive and validating the configuration.

2. Add the protocol policy to the HTTPS virtual host

Edit the configuration file that contains the site’s active TLS virtual host. Place the directive inside that block:

<VirtualHost *:443>
    ServerName example.com
    # existing certificate and document-root directives
    Protocols h2 http/1.1
</VirtualHost>

Replace the example hostname and retain the certificate, key, document-root, logging, and other directives already required by the site. The important part is the placement: Protocols h2 http/1.1 must apply to the virtual host that receives the HTTPS request.

Apache also permits protocol configuration in broader server context. A virtual-host setting is usually the safer choice on a server hosting multiple sites because it limits HTTP/2 to the sites you have deliberately configured. Other virtual hosts can remain HTTP/1.1-only until you change them.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

3. Test the syntax before reloading

Ask Apache to parse its configuration:

sudo apache2ctl configtest

Proceed only when the command reports valid syntax. If it identifies a file and line number, open that location and correct the error. Common causes include placing the directive outside a valid context, misspelling a directive, or editing a different file from the one Apache is loading.

4. Reload Apache

After a successful test, reload the service:

sudo systemctl reload apache2

A reload applies configuration changes without the normal interruption associated with a full stop and start. Ubuntu’s Apache module workflow requires a reload or restart after configuration changes. If a reload does not apply the change or the service manager reports a problem, a full restart can be used after you have confirmed that the configuration test succeeds.

Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord | 6.35mm Jack, Durable Design, Stage and Home Studio Use, Low Noise Shielded Electric Cord for Bass, Keyboard, Amp, Mixer
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Verify that Apache is really serving HTTP/2

Check that the module is loaded

Inspect Apache’s loaded-module list:

apache2ctl -M | grep http2

The exact formatting depends on the installed Apache build, but the command should show the HTTP/2 module when it is loaded. If it returns nothing, revisit sudo a2enmod http2, the installed package version, and the service reload.

Test protocol negotiation from a client

Use an HTTP/2-capable curl build against the HTTPS URL:

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
curl -I --http2 https://example.com/

For a more explicit diagnostic trace, run:

curl -v --http2 https://example.com/

Inspect the verbose exchange for the negotiated protocol. A successful HTTP/2 request is identified as HTTP/2 in the client trace rather than HTTP/1.1. The exact output depends on the versions and build options of both curl and Apache, so use the protocol line and negotiation details rather than expecting one fixed header layout.

Run the test from a client that supports HTTP/2 and use the same hostname that browsers use. Testing an origin address, a different hostname, or plain HTTP can select another virtual host or bypass the TLS ALPN negotiation entirely.

Confirm that the intended virtual host handled the request

If the client still reports HTTP/1.1, check the request path as well as the module state. Confirm all of the following:

  • The URL is https://, not plain http://.
  • The hostname resolves to the server you changed.
  • The TLS certificate and virtual host correspond to that hostname.
  • The Protocols directive is inside the matching <VirtualHost *:443> block.
  • Apache was reloaded after the edit.
  • The client actually supports HTTP/2.

Understand h2 versus h2c

Configuration Transport Typical use Browser-facing recommendation
h2 HTTP/2 over TLS, negotiated with ALPN HTTPS websites Use with http/1.1 as the normal public-site configuration
h2c Cleartext HTTP/2 Controlled server-to-server deployments with a deliberate cleartext requirement Do not enable merely because it appears in a generic example
http/1.1 Traditional HTTP/1.1 Fallback for clients that do not negotiate HTTP/2 Keep alongside h2 for broad compatibility

Apache documents both HTTP/2 schemes, but the normal browser deployment is h2 on an HTTPS virtual host. RFC 9113 identifies h2 as the ALPN identifier for HTTP/2 over HTTPS and treats the old HTTP Upgrade use of h2c as obsolete.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

Do not put Protocols h2 h2c http/1.1 on a public site simply to make the list look more complete. That configuration also enables cleartext negotiation. Use h2c only when you control both endpoints, understand the transport and security implications, and specifically need it. For an ordinary Ubuntu website, Protocols h2 http/1.1 in the TLS virtual host is the appropriate policy.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Control scope on a server with multiple sites

Virtual-host scope

Putting the directive in one <VirtualHost *:443> block limits it to that site’s HTTPS traffic. This is useful when you are migrating sites one at a time, when different applications have different compatibility requirements, or when you want to test one hostname before changing the rest of the server.

Global server scope

A broader server-context setting can affect more than one virtual host. That may be intentional on a single-site server, but it increases the chance that an unrelated site changes protocol behavior. If the wrong site changes after a reload, move the directive into the specific TLS virtual-host block and test again.

Troubleshoot common failures

“Invalid command ‘Protocols’”

This message means Apache does not recognize the directive in the configuration it is parsing. The usual checks are:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Run sudo a2enmod http2.
  2. Run apache2ctl -M | grep http2 to see whether the module is loaded.
  3. Check the installed Apache package and its version; Apache lists mod_http2 compatibility from 2.4.17 onward.
  4. Run sudo apache2ctl configtest again after correcting the module or package issue.

If the installed Ubuntu package is too old or comes from a release with known module limitations, update the supported package or upgrade the operating system rather than relying on an obsolete build.

The browser falls back to HTTP/1.1

Fallback is expected when a client cannot use HTTP/2, but it can also indicate a TLS or virtual-host problem. Verify that the request is HTTPS, ALPN is available, and the certificate and TLS virtual host are the ones serving the hostname. Apache notes that unsuitable TLS protocol or cipher settings can cause clients to refuse HTTP/2 and fall back to HTTP/1.1.

Use curl -v --http2 to separate client capability from browser behavior. If curl negotiates HTTP/2 while a particular browser does not, investigate that browser’s connection path and TLS policy. If both use HTTP/1.1, inspect the server-side module, directive scope, TLS policy, and reload state.

The wrong site changes

Move Protocols h2 http/1.1 out of global context and into the intended <VirtualHost *:443> block. Then run the configuration test, reload Apache, and verify using the exact hostname. Multiple HTTPS virtual hosts make hostname matching important; a request that reaches a different block will use that block’s protocol policy.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The reload fails

Do not keep retrying reloads while the configuration is invalid. Run:

sudo apache2ctl configtest

Read the reported file and line, fix the syntax, and repeat the test. Only after it succeeds should you run sudo systemctl reload apache2. This sequence prevents a typo in the new directive from becoming a service-management problem.

An old Ubuntu release is involved

Older Ubuntu advisories document both availability gaps and security problems in historical mod_http2 packages. Treat the release and package version as part of the configuration decision. Bring the host to a supported, security-updated state before enabling HTTP/2, then repeat the module, syntax, reload, and client-negotiation checks.

Operational checklist

  • Ubuntu and Apache are on a supported, security-updated package level.
  • The site has a working HTTPS virtual host on port 443.
  • mod_http2 is enabled with sudo a2enmod http2.
  • Protocols h2 http/1.1 is inside the intended TLS virtual host.
  • sudo apache2ctl configtest succeeds before any reload.
  • sudo systemctl reload apache2 completes successfully.
  • apache2ctl -M | grep http2 shows the module.
  • curl -v --http2 https://example.com/ confirms the negotiated protocol.
  • h2c is not enabled unless a controlled cleartext requirement specifically calls for it.

What success looks like

Successful enablement has three separate parts: Apache loads mod_http2, the relevant HTTPS virtual host advertises h2 and http/1.1, and an HTTP/2-capable client negotiates h2 over TLS. Checking only one of those conditions can produce a false sense that HTTP/2 is active. The module list, configuration test, service reload, and verbose client trace together establish whether the request is actually being served through HTTP/2.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

ApacheHTTP/2Linux administrationUbuntuweb servers

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.