Traefik’s Built‑in HTTP/2 and TLS 1.3: Enabling Faster, Safer HTTPS Without Extra Work

Problem & Takeaway

When you expose a web service through a reverse proxy, latency and security are constant concerns. A slow TLS handshake or an old HTTP/1.1 connection can hurt user experience and expose you to head‑of‑line blocking. Traefik can handle both automatically, so you spend less time tweaking configuration and more time delivering content.

Why HTTP/2 and TLS 1.3 matter

HTTP/2 multiplexes multiple requests over a single TCP connection, eliminating many of the delays caused by the classic HTTP/1.1 request‑response cycle. TLS 1.3 reduces handshake round‑trips from two to one, cuts latency, and removes weak cipher suites. Together they give a noticeably faster, more secure connection for end users.

Traefik’s automatic HTTP/2 negotiation

Traefik watches the client’s Upgrade: h2c or ALPN values during the TLS handshake. If the client offers HTTP/2, Traefik upgrades the connection without any extra flag. This works for Docker, Kubernetes, and static file backends because the protocol negotiation happens at the proxy layer, not the upstream service.

TLS 1.3 defaults and per‑entry‑point overrides

Starting with Traefik v2.7, TLS 1.3 is enabled by default, provided the underlying Go runtime implements the required cipher suites. You can still fine‑tune the protocol version, allowed cipher suites, or disable session tickets by overriding the tls section of a specific entry point. The default behavior is safe for most deployments, but explicit overrides give you control when compliance or performance tuning is required.

Worked example

Below is a minimal Docker‑Compose setup that demonstrates the default behavior and an explicit TLS 1.3 override.

version: "3.8"
services:
  traefik:
    image: traefik:latest
    command:
      - "--api.insecure"
      - "--providers.docker"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro

  whoami:
    image: traefik/whoami
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=myresolver"

The traefik.yml file (mounted as a volume) contains the TLS configuration. By default, Traefik will negotiate HTTP/2 if the client supports it and will use TLS 1.3 because the Go runtime in the official image includes it.

# traefik.yml
entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

tls:
  # Default: TLS 1.3 enabled, HTTP/2 auto‑negotiated
  # You can override per entry point if needed
  # Example of a stricter configuration:
  # [entryPoints.websecure.tls]
  #   minVersion = "1.2"
  #   cipherSuites = ["TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"]

To verify that HTTP/2 is active, run a curl request that explicitly asks for HTTP/2:

1. Check the Traefik version to ensure you are on v2.7 or newer.

docker exec -it $(docker ps -q -f name=traefik) traefik version

2. Issue a request with the --http2 flag and ask curl to show response headers.

curl -I --http2 -k https://yourhost

3. Look for the HTTP/2 200 line in the output; it confirms successful protocol negotiation.
4. Inspect the /metrics endpoint (exposed via the insecure API) for counters such as http2_requests_total and tls13_handshakes_total. These metrics confirm that the proxy is using the newer protocol.

Limitations & verification checklist

• Traefik v1.x and early 2.x releases lack full HTTP/2 support; confirm you are running v2.7 or newer.
• TLS 1.3 requires a Go runtime that implements the protocol. Older Go binaries may silently fall back to TLS 1.2, which you can verify by checking the Go version in the container’s VERSION label.
• Custom tls settings for an entry point can disable HTTP/2 even when the client offers it. Review the static configuration for any minVersion or cipherSuites that restrict protocol versions.

Practical verification steps:

1. Run traefik version inside the container or on the host to confirm the release.
2. Execute curl -I --http2 -k https://yourhost and verify the HTTP/2 response header.
3. Query /metrics (e.g., curl http://localhost:8080/metrics) and look for http2 and tls13 counters.
4. Optionally, use openssl s_client -connect yourhost:443 -http2 -tls1_3 to see the negotiated protocol directly.

Actionable closing

If you are still on an older Traefik version, upgrade to v2.7 or later. Ensure the Go runtime in your deployment matches the requirements (Go 1.19+). Apply the minimal traefik.yml shown above, then run the verification commands. Once the HTTP/2 header appears and the metrics show tls13 activity, you have enabled the performance and security benefits of HTTP/2 and TLS 1.3 with no extra backend changes.