I'd like to have a listener understanding HTTP/2 without TLS ("prior knowledge HTTP/2"). The listener should then translate the received traffic into HTTP/1.1 and forward it to a desired location.

What would be an easy way to achieve this?

HAProxy appears to be a natural first choice, but unfortunately, non-TLS/ALPN listeners aren't currently supported

As for Apache, this appears relevant and appears to imply it's not possible (not sure, as I have little experience with Apache):

mod_proxy_http2 supports HTTP/2 only, it does not provide any downgrades to HTTP/1.1. This means that the backend needs to support HTTP/2 because HTTP/1.1 will not be used instead.

If there's a way to do this with Apache or Nginx, a pointer to a sample configuration file I could start from would be helpful.

This is for penetration testing purposes.

closed as off-topic by Steffen Ullrich, Anders, forest, Xiong Chiamiov, Benoit Esnard Mar 5 '18 at 22:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, Anders, forest, Xiong Chiamiov, Benoit Esnard
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    The ways to do such translation have nothing to do with security. And while your ultimate goal is related to security the techniques you ask for are not. That's why I propose to close it as off-topic. – Steffen Ullrich Mar 1 '18 at 8:51

Browse other questions tagged or ask your own question.