HTTP/3 handshake rejections on lsquic-based servers

Nimble Streamer team actively maintains the HTTP/3 and QUIC feature set.

Recently, an active Nimble customer brought us an interesting case. The curl tool built on ngtcp2 sometimes fails to connect via HTTP/3.

Here’s how it appears:

$ curl -v --http3-only https://media.example.com/
*   Trying 203.0.113.10:443...
* QUIC connect to 203.0.113.10 port 443 failed: Could not connect to server
* Failed to connect to media.example.com:443 after 93 ms: Could not connect to server
curl: (7) Failed to connect

After our investigation, we figured out that this issue affects OpenLiteSpeed, LiteSpeed Web Server, Nimble Streamer, and other servers built on LiteSpeed’s lsquic library. A server intermittently rejects QUIC handshakes – typically 35–60% of attempts.

This is the expected behavior of the lsquic library, with this specific curl+ngtcp2 build. It’s a deliberate pre-handshake resource-limiting (anti-DDoS) mechanism in the lsquic library.

To avoid this issue, use “–curves x25519” parameter when calling curl:

$ curl -v --http3-only--curves x25519 https://media.example.com/

What about browsers?

Notice that Firefox, Chrome and Edge browsers are not affected and do not cause such connections failure.

Let us know if you have any other questions about HTTP/3 and QUIC protocols and feature set.