I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2.

According to the bug report, it looks like it's kinda optional, and an afterthought:


There's also a FAQ entry:


Does HTTP/2 require encryption?

No. After extensive discussion, the Working Group did not have consensus to require the use of encryption (e.g., TLS) for the new protocol.

However, some implementations have stated that they will only support HTTP/2 when it is used over an encrypted connection.

However, it's unclear how it relates to opportunistic encryption, where implementation would be [kinda] mandatory, but actual support [somewhat] optional.

However, according to IETF "Pervasive Monitoring Is an Attack", Best Current Practice 188, it would seem like opportunistic encryption is supposed to be made mandatory is all protocol designs:


Is HTTP/2 being designed in violation of BCP 188, RFC 7258?

  • "it would seem like opportunistic encryption is supposed to be made mandatory is all protocol designs" -- Needs to be considered but is not mandatory. From RFC 7258: "Those developing IETF specifications need to be able to describe how they have considered PM, and, if the attack is relevant to the work to be published, be able to justify related design decisions.".
    – Daniel
    Commented Apr 7, 2015 at 16:11

1 Answer 1


Yes, it appears optional. According to http://daniel.haxx.se/blog/2015/03/06/tls-in-http2/, it was originally part of the HTTP/2 specification, but was later moved into its own spec as an extension of HTTP/2, https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-alt-svc-06.

It would appear that it was finally implemented in Mozilla in late 2014, and was finally enabled and will be shipping with Firefox 37.



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .