4514-nginx-openhttp2 - Recommend Enabling HTTP/2.0 (Recommend, Does Not Affect Security Options) - Guance Docs

Skip to content

Rule ID¶

4514-nginx-openhttp2

Category¶

nginx

Level¶

info

Compatible Versions¶

Linux

Description¶

Session resumption for HTTPS sessions should be disabled to enable Perfect Forward Secrecy.

Scan Frequency¶

0 */30 * * *

Rationale¶

HTTP/2.0 introduces performance benefits through full multiplexing and also provides security benefits. HTTP/2.0 improves cipher suite requirements and blacklisting. It also disables session renegotiation and TLS compression. This helps prevent vulnerabilities such as CRIME and ensures stronger encryption.

Risk Items¶

nginx security

Audit Method¶

Execute the following command to verify:

grep -ir http2 /etc/nginx
# The output should contain the following:
listen 443 ssl http2;

Remediation¶

Edit the file /etc/nginx/nginx.conf or files related to HTTPS configuration. Example:

server {
 listen 443 ssl http2;
}

Impact¶

None

Default Value¶

The highest protocol enabled by default is HTTP/1.1

References¶

server-side-tls

CIS Controls¶

None