mod_http3: HTTP/3 for the Apache HTTP Server

mod_http3 adds HTTP/3 (RFC 9114) to the Apache HTTP Server. It uses OpenSSL 3.5 for QUIC (RFC 9000, transport and TLS 1.3) and nghttp3 for HTTP/3 framing, and it plugs into httpd's normal request pipeline, so virtual hosts, filters, and handlers work as they do for HTTP/1.1 and HTTP/2. Alt-Svc headers tell browsers it is there.

The hard part

httpd's worker model assumes TCP: the kernel accepts a connection and hands a socket to a worker. QUIC runs over UDP, multiplexes many streams on one socket, and keeps connection state in the server process, not the kernel. httpd did not know these connections existed, so a graceful restart could kill a child in the middle of a request.

I added two optional functions to httpd's process-management layer so a module can register connections httpd did not accept itself. All four MPMs (httpd's process models) honour them, and graceful stop and restart now drain in-flight HTTP/3 requests on Linux and Windows. The change is proposed upstream for trunk and the 2.4.x branch.

Structure and verification

The original single-file demo became listener, connection, stream, and request units, with every OpenSSL QUIC call behind one internal interface. The build targets stable 2.4.x or trunk.

Verification: 56 integration tests driven by pytest against a real server, unit tests over the dependency stack, seven CI workflows, registration with the QUIC Interop Runner, signed tags, deb and rpm packages, Linux and Windows tarballs, container images, and a documentation site. Between 2 April and 18 August 2026 the changelog gained 159 entries; 155 are mine.

Status

It works and is marked experimental. It serves curl, Firefox, and Chrome, passes its own suite, and passes the QUIC Interop Runner HTTP/3 case. Connection migration and 0-RTT are not implemented.