5

According to the HTTP/2 spec (rfc7540), implementations of HTTP/2 require TLS version 1.2 or higher.

Implementations of HTTP/2 MUST use TLS version 1.2 [TLS12] or higher for HTTP/2 over TLS

However, in the HTTP2 FAQ documentation, HTTP/2 does not require encryption(e.g., TLS).

No. After extensive discussion, the Working Group did not have consensus to require the use of encryption (e.g., TLS) for the new protocol.

I am little bit confused. Can you explain it to me to understand it more?

3
  • 4
    I read this as "if you're going to support HTTP/2 over TLS, you have to use TLS version 1.2 or higher". Apr 6, 2020 at 0:19
  • 1
    In other words, parse it as "(Implementations of HTTP/2 MUST use TLS version 1.2 [TLS12] or higher) for HTTP/2 over TLS"; the MUST only applies when actually using HTTP/2 over TLS. You seem to be parsing as "Implementations of HTTP/2 MUST (use TLS version 1.2 [TLS12] or higher for HTTP/2 over TLS)" which I don't think was intended. Apr 6, 2020 at 0:21
  • @NateEldredge Thanks for the kind answer. I fully understood. Apr 6, 2020 at 0:48

0

Browse other questions tagged or ask your own question.