<p>I have a Go server that is currently running with Kubernetes on AWS. The website sits under a route-53 and an ELB that manages the SSL termination.
Now, I want to support HTTP/2 in my web-server in order to push resources to the clients, and I saw that HTTP/2 requires that the web-server will use HTTPS. I have a few questions according to that.</p>

<ul>
<li><p>HTTP/2 requires HTTPS - In my case the HTTPS logic is in the ELB and it manages for me the SSL termination. My application gets the decrypted data as a simple HTTP request. Do I need to remove the ELB in order to enable HTTP/2 in my web-server?
Is there any way to leave the ELB there and enable HTTP/2 in my web-server? </p></li>
<li><p>In my local development I use openssl to generate certificate. If I deploy the web-server I need to get the CA certificate from AWS and store it somewhere in the Kubernetes certificate-manager and inject to my web-server in the initialization. What is the recommended way to do this? </p></li>
</ul>

<p>I feel like I miss something, so I'll appreciate any help. Thanks</p>

mux
<p>The new ELB supports HTTP/2 (<a href="https://aws.amazon.com/blogs/aws/new-aws-application-load-balancer/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/aws/new-aws-application-load-balancer/</a>) but not the Push attribute (<a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#listener-configuration" rel="nofollow noreferrer">https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#listener-configuration</a>): “You can't use the server-push feature of HTTP/2”</p>

<p>If you want to use Push you can use the ELB as a level four TCP LoadBalancer and enable this at your webserver. For HaProxy it is also possible to still offset SSL/TLS with this set up (<a href="https://stackoverflow.com/questions/38730281/http-2-behind-reverse-proxy">HTTP/2 behind reverse proxy</a>) but not sure if similar is possible under ELB (probably not). This is because while HTTP/2 requires HTTPS from all the major browsers it is not a requirement of the protocol itself so load balancer -> server can be over HTTP/2 without HTTPS (called h2c).</p>

<p>However I would say that HTTP/2 Push is very complicated to get right - read this excellent post by Jake Archibald of Google on this: <a href="https://jakearchibald.com/2017/h2-push-tougher-than-i-thought/" rel="nofollow noreferrer">https://jakearchibald.com/2017/h2-push-tougher-than-i-thought/</a>. It’s generally been found to benefit in a few cases and cause no change in most and even cause degradation in performance in others. Ultimately it’s a bit of a let down in HTTP/2 features, though personally I don’t think it’s been explored enough so may be some positives to come out of it yet.</p>

<p>So if you don’t want Push then is there still a point in upgrading to HTTP/2 on the front end? Yes in my opinion as detailed in my answer here: <a href="https://stackoverflow.com/questions/41637076/http2-with-node-js-behind-nginx-proxy">HTTP2 with node.js behind nginx proxy</a>. This also shows that there is no real need to have HTTP/2 on the backend from LB to webserver meaning you could leave it as a HTTPS offloading loaf balancer.</p>

<p>It should be noted that there are some use cases where HTTP/2 is slower:</p>

<ol>
<li>Under heavy packet loss (i.e. a very bad Internet connection). Here the single TCP connection used by HTTP/2 and it’s TCP Head of Line Blocking means the connection suffers more than 6 individual HTTP/1 connections. QUIC which is a even newer protocol then HTTP/2 (so new it’s not even out yet, so not really available except on Google servers) addresses this.</li>
<li>For large packets due to AWS’s specific implementation. Interesting post here on that: <a href="https://medium.com/@ptforsberg/on-the-aws-application-load-balancer-http-2-support-fad4bc67b21a" rel="nofollow noreferrer">https://medium.com/@ptforsberg/on-the-aws-application-load-balancer-http-2-support-fad4bc67b21a</a>. This is only really an issue for truely large downloads most likely for APIs and shouldn’t be an issue for most websites (and if it is then you should optimise your website cause HTTP/2 won’t be able to help much anyway!). Could be easily fixed by upgrading the HTTP/2 window size setting but looks like ELB does not allow you to set this.</li>
</ol>
