HTTP/3 option served the default self-signed certificate to all HTTP/3 clients

Hi ploi team,

we ran into a problem with the "Use HTTP/3" option. I'm not sure if this is a bug on your side or a result of our own server configuration, but it caused real issues for our users, so I want to report it.

Setup: Ubuntu server managed by ploi, one site with a Let's Encrypt certificate. HTTP/3 was enabled via the "Use HTTP/3" checkbox when requesting the certificate in the SSL tab.

Enabling the option created /etc/nginx/conf.d/http3.conf with this content:

server { 
   listen 443 quic reuseport;
   listen [::]:443 quic reuseport;
   ssl_certificate /etc/nginx/ploi/default/nginx.crt;
   ssl_certificate_key /etc/nginx/ploi/default/nginx.key;
}

It also added add_header Alt-Svc 'h3=":443"; ma=86400'; to the site's SSL include (/etc/nginx/ssl/sitename). The site's own server block however only got listen 443 ssl. No listen 443 quic was added to the vhost itself.

The consequence: the nameless server block in http3.conf was the only server attached to the QUIC/UDP listener. Since nginx matches SNI per listener, every HTTP/3 connection landed in that block regardless of SNI and was served the self-signed default certificate instead of the site's Let's Encrypt certificate.

Chrome and Firefox silently fell back to TCP, so this went unnoticed for weeks. Apple clients (iOS Safari and WKWebView apps) treat the untrusted certificate as a hard TLS failure (NSURLErrorDomain -1200, "TLS Trust evaluation failed") and do not fall back. As a result, iOS users intermittently got "server not reachable", while every TCP-based diagnostic (curl, openssl, SSL Labs) showed a healthy setup. That combination made the issue hard to track down.

Our workaround: we re-issued the certificate without the HTTP/3 checkbox and removed /etc/nginx/conf.d/http3.conf manually. Everything works now.

If this is expected behavior and the site vhost was supposed to get its own quic listener through some other step, please let me know what we missed. Otherwise it might make sense for the HTTP/3 option to add listen 443 quic; and the site certificate to the site's server block instead of the standalone block with the default certificate.

Let me know if you need more details.