dotnet / dotnet/aspnetcore

Kestrel doesn't respond to HTTP3 request on udp

Open
#63,330 6 comments 0 reactions 1 assignee Claimed by @JamesNK View on GitHub
area-networking feature-kestrel HTTP3
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

I have created a YARP proxy and enabled HTTP3 along with libmsquic in docker.

Server only respond to HTTP2 and by using url http3check , it seems server doesn't respond to HTTP3 even on same machine, `netstat -lnu` shows up that container is listening correctly but there is no response.

### Expected Behavior

Server should respond to http3 requests...

```
docker run -ti --rm alpine/curl-http3 curl --http3-only -sI https://validurl.....
```

There should be a valid response like `HTTP/3 200`. But it times out.

But in case of following,

```
docker run -ti --rm alpine/curl-http3 curl --http3 -sI https://validurl.....
```

Response is, curl gets response with HTTP/2
```
HTTP/2 200
content-type: text/html; charset=utf-8
date: Tue, 19 Aug 2025 08:18:07 GMT
server: Kestrel
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, max-age=0
```

### Steps To Reproduce

```dockerfile
FROM mcr.microsoft.com/dotnet/sdk:8.0-alpine AS base

RUN apk add libmsquic

WORKDIR /app

COPY . .

RUN dotnet build -c Release -o /app/build

EXPOSE 443/tcp
EXPOSE 443/udp

ENTRYPOINT [ "dotnet", "/app/build/DotNetReverseProxy.dll"]
```

```c#
var builder = WebApplication.CreateBuilder(args);
builder.WebHost.ConfigureKestrel(kestrel =>
{
var tls = new TlsHandshakeCallbackOptions
{
OnConnection = async (c) =>
{
var fwd = await store.GetCertificate(c.ClientHelloInfo.ServerName);
var ctx = cache.GetOrCreate(fwd.Cert, (ci) =>
{
var xCert = X509Certificate2.CreateFromPem(fwd.Cert, fwd.Key);

ci.AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(15);

return new SslServerAuthenticationOptions
{
ServerCertificate = xCert,
EnabledSslProtocols = System.Security.Authentication.SslProtocols.Tls13
| System.Security.Authentication.SslProtocols.Tls12
};
});
var unixEndPoint = new UnixDomainSocketEndPoint(fwd.Port);
cache.Set(c.Connection.ConnectionId, unixEndPoint);
return ctx;
}
};

// following isn't working either...
//var ip = new IPAddress([0, 0, 0, 0]);
//kestrel.Listen(ip, 443, portOptions => {
// portOptions.Protocols = HttpProtocols.Http1AndHttp2AndHttp3;
// portOptions.UseHttps(tls);
//});

kestrel.ListenAnyIP(443, portOptions => {
portOptions.Protocols = HttpProtocols.Http1AndHttp2AndHttp3;
portOptions.UseHttps(tls);
});
});
```

### Exceptions (if any)

None

### .NET Version

8

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.