Is TLS mandatory for HTTP/2? [duplicate]
Asked Answered
B

0

8

According to the HTTP/2 spec (rfc7540), implementations of HTTP/2 require TLS version 1.2 or higher.

Implementations of HTTP/2 MUST use TLS version 1.2 [TLS12] or higher for HTTP/2 over TLS

However, in the HTTP2 FAQ documentation, HTTP/2 does not require encryption(e.g., TLS).

No. After extensive discussion, the Working Group did not have consensus to require the use of encryption (e.g., TLS) for the new protocol.

I am little bit confused. Can you explain it to me to understand it more?

Boardman answered 6/4, 2020 at 0:14 Comment(3)
I read this as "if you're going to support HTTP/2 over TLS, you have to use TLS version 1.2 or higher".Irritative
In other words, parse it as "(Implementations of HTTP/2 MUST use TLS version 1.2 [TLS12] or higher) for HTTP/2 over TLS"; the MUST only applies when actually using HTTP/2 over TLS. You seem to be parsing as "Implementations of HTTP/2 MUST (use TLS version 1.2 [TLS12] or higher for HTTP/2 over TLS)" which I don't think was intended.Irritative
@NateEldredge Thanks for the kind answer. I fully understood.Boardman

© 2022 - 2024 — McMap. All rights reserved.