Introduction

Enabling HTTP/2 in Spring Boot with embedded Tomcat is mostly about getting the transport stack right. The usual failure mode is enabling server.http2.enabled=true and then assuming the protocol will negotiate automatically even though SSL, ALPN support, or a reverse proxy still blocks the path.

The Core Requirements

For the usual browser-facing setup, HTTP/2 over Tomcat typically needs:

• Spring Boot version that supports HTTP/2 configuration
• embedded Tomcat with HTTP/2 support
• TLS enabled on the connector
• a Java runtime with ALPN support

In practice, modern JDKs make this easier than older Java versions. If you are on a current JDK and recent Spring Boot line, the configuration is much simpler than it used to be.

Turn On HTTP/2 in Spring Boot

The Spring Boot flag is straightforward:

1server.http2.enabled=true
2server.port=8443
3server.ssl.enabled=true
4server.ssl.key-store=classpath:keystore.p12
5server.ssl.key-store-password=changeit
6server.ssl.key-store-type=PKCS12
7server.ssl.key-alias=tomcat

This tells Boot to start Tomcat with SSL enabled and HTTP/2 support requested.

The TLS part matters. In most real deployments, HTTP/2 over browsers is negotiated over TLS. If you skip TLS, many clients will never use HTTP/2 even if the server side is otherwise capable.

A Minimal Spring Boot Application

A small controller is enough to test the protocol once the server is configured.

1import org.springframework.boot.SpringApplication;
2import org.springframework.boot.autoconfigure.SpringBootApplication;
3import org.springframework.web.bind.annotation.GetMapping;
4import org.springframework.web.bind.annotation.RestController;
5
6@SpringBootApplication
7public class DemoApplication {
8    public static void main(String[] args) {
9        SpringApplication.run(DemoApplication.class, args);
10    }
11}
12
13@RestController
14class HelloController {
15    @GetMapping("/")
16    public String hello() {
17        return "hello over http2";
18    }
19}

With the SSL and HTTP/2 properties in place, this is enough for a local verification run.

Test the Negotiated Protocol

Do not assume HTTP/2 is active just because the app starts. Check the negotiated protocol explicitly.

Using curl:

curl -k --http2 -I https://localhost:8443/

The response should show an HTTP/2 protocol line when negotiation succeeds.

You can also inspect the browser developer tools network panel. That often shows the protocol used for the request.

Understand the Tomcat Side

If Spring Boot is using embedded Tomcat, Boot handles most of the connector wiring. Even so, the lower-level rule still matters: Tomcat can only negotiate HTTP/2 when the runtime and connector settings support it end to end.

If HTTP/2 does not activate, check these layers:

1. SSL is really enabled
2. the JDK supports ALPN for your runtime path
3. the embedded Tomcat version supports HTTP/2
4. a reverse proxy in front is not terminating TLS and downgrading the backend protocol

That last point matters in real deployments. If Nginx, Apache, or a cloud load balancer sits in front of the app, the browser may speak HTTP/2 to the edge while the proxy forwards HTTP/1.1 to Tomcat. That is not inherently wrong, but it means Tomcat-level HTTP/2 might not change the user-facing protocol at all.

Local SSL Material for Testing

For local development, a self-signed certificate is enough to prove the protocol path.

1keytool -genkeypair \
2  -alias tomcat \
3  -keyalg RSA \
4  -storetype PKCS12 \
5  -keystore keystore.p12 \
6  -storepass changeit \
7  -validity 365

Place the generated keystore where Spring Boot can load it, then start the application and test with curl -k.

Common Pitfalls

• Enabling server.http2.enabled=true without configuring SSL.
• Assuming HTTP/2 is active without verifying the negotiated protocol.
• Forgetting that a reverse proxy may terminate HTTP/2 before traffic reaches Tomcat.
• Using an older runtime or stack combination that lacks proper ALPN support.
• Debugging controller code when the real issue is connector or TLS configuration.

Summary

• HTTP/2 on Spring Boot with Tomcat depends on connector and TLS configuration, not controller code.
• In most browser-facing setups, the Boot flag and SSL both need to be configured.
• Verify negotiation with curl --http2 or browser tools instead of assuming it worked.
• Check whether a reverse proxy terminates or downgrades the protocol before traffic reaches Tomcat.
• Treat HTTP/2 enablement as an end-to-end transport concern rather than a single property toggle.