To solve this, I used an HTTP/2 proxy called nghttpx, which translates HTTP/1.x requests to HTTP/2 and vice-versa.
I used SSLSplit to MiTM the connection, and nghttpx as a secondary proxy between the downgraded requests from SSLSplit and the server. Here is a quick diagram:
Client Request [HTTP/2] -> SSLSplit [HTTP/1.1] -> nghttpx [HTTP/2] -> Server
Server Reply [HTTP/2] -> nghttpx [HTTP/1.1] -> SSLSplit [HTTP/1.1] -> Client
In my use case, the client was making requests to multiple domains, but only one of them was HTTP/2. The domain in question was resolving to multiple IP addresses, so I didn't bother using
iptables and just added a rule to my
/etc/hosts to resolve that domain to
I then fired up SSLSplit with my regular
iptables setup and started nghttpx:
nghttpx -k -f'*,443' -b'IP_ADDR,443;;proto=h2;tls' mitmca.key mitmca.crt -L INFO
Depending on your use case, you might have requests for multiple domains, which will need nghttpx listening on a separate port for each domain, and
iptables entries for each one.
Hopefully standard MiTM tools will add full support for HTTP/2 in the future, but for now, this is a good enough solution.