[warning] Transport option {:next_protocols_advertised, ["h2", "http/1.1"]} unknown or invalid.

[eriknaslund]

When running a Phoenix project using plug_cowboy 2.7.5 I get the following warning on startup:

[warning] Transport option {:next_protocols_advertised, ["h2", "http/1.1"]} unknown or invalid.

I believe this is happening because of the code here:

plug_cowboy/lib/plug/cowboy.ex

Lines 293 to 294 in 553b43e

	|> Keyword.put_new(:next_protocols_advertised, ["h2", "http/1.1"])
	|> Keyword.put_new(:alpn_preferred_protocols, ["h2", "http/1.1"])

From what I gather :next_protocols_advertised has been deprecated (https://www.erlang.org/doc/apps/ssl/ssl.html#t:server_option_legacy/0) in favor of :alpn_preferred_protocols.

Maybe there are some backwards compatibility issues that are problematic, but otherwise I think it'd be great to simply remove the setting of :next_protocols_advertised. If that's not possible maybe we could create a way to explicitly unset :next_protocols_advertised, similar to the code below?

config :app, AppWeb.Endpoint,
    ...
    https: [
        ...
        transport_options: [
            socket_opts: [
                next_protocols_advertised: nil
            ]
        ]
    ]    

[SamHutchings]

This also appears to be causing issues with plug 1.19.x when using the cipher_suite: :strong option, as this now enforced TLS 1.3 only by default.

When starting the project you see the below:

** (Mix) Could not start application example_app: Example.App.Application.start(:normal, []) returned an error: shutdown: failed to start child: Example.App.Endpoint
    ** (EXIT) shutdown: failed to start child: {:ranch_listener_sup, Example.App.Endpoint.HTTPS}
        ** (EXIT) shutdown: failed to start child: :ranch_acceptors_sup
            ** (EXIT) an exception was raised:
                ** (ArgumentError) errors were found at the given arguments:

  * 1st argument: not an atom

(erts 15.2) :erlang.atom_to_binary({:options, :incompatible, [:next_protocols_advertised, {:versions, [:"tlsv1.3"]}]})
(stdlib 6.2) erl_posix_msg.erl:176: :erl_posix_msg.message_1/1
(stdlib 6.2) erl_posix_msg.erl:30: :erl_posix_msg.message/1
(ranch 1.8.1) /deps/ranch/src/ranch_acceptors_sup.erl:65: :ranch_acceptors_sup.listen_error/5
(stdlib 6.2) supervisor.erl:869: :supervisor.init/1
(stdlib 6.2) gen_server.erl:2229: :gen_server.init_it/2
(stdlib 6.2) gen_server.erl:2184: :gen_server.init_it/6
(stdlib 6.2) proc_lib.erl:329: :proc_lib.init_p_do_apply/3

Workaroundable by using compatible cipher suites, or explicitly allowing TLS 1.2, but it looks like it's stopping the use of TLS 1.3 exclusively.

EDIT: This may be due to an outdated ranch version (1.8.1).

[josevalim]

Can someone investigate when the alpn_preferred_protocols was introduced in Erlang/OTP, and send a PR so we can stop setting the next_... one? Thanks.

[eriknaslund]

I was a bit off in my troubleshooting at first. It wasn't the OTP ssl library that was emitting the warning but rather the ranch library.

This warning started being issued in ranch 2.1, which was released on 2021-09-09. It's mentioned here in their upgrade notes. Apparently I too had been running an outdated ranch (1.8) for quite a while until recently.

Chrome even dropped support for NPN (next_protocols_advertised) already back in 2016-04, so it feels like it should be pretty safe to outright stop setting next_protocols_advertised, just like you suggested.

I'll send a PR tomorrow.

[eriknaslund]

@josevalim Tiny 2-line PR created. Tests pass and I verified that the warning on startup disappeared.