HTTP/2 is allowed to work over insecure connections as per the spec, but all browser vendors have decided that their browsers will not support unencrypted H/2 (

HTTP/2 is allowed to work over insecure connections as per the spec, but all browser vendors have decided that their browsers will not support unencrypted H/2 (no browser at all currently allows H/2 over HTTP). This means that in theory H/2 can run insecurely, but in practice it cannot. https://http2.github.io/faq/#does-http2-require-encryption https://http2.github.io/faq/#does-http2-require-encryption