How to enable HTTP/2 on secondary domain vhosts in CyberPanel without GUI reset

Root Cause Diagnosis

When secondary domains or child vhosts are created in CyberPanel, OpenLiteSpeed/LiteSpeed Web Server (OLS/LSWS) inherits virtual host listener bindings that often lack explicit HTTP/2 protocol declarations or ALPN (Application-Layer Protocol Negotiation) flags. Updating virtual host parameters or toggling SSL via the CyberPanel GUI regularly overwrites custom vhost settings back to default templates, stripping manual enableHttp2 directives. Because CyberPanel’s backend parser regenerates vhost files from template definitions upon GUI saves, enabling HTTP/2 permanently without GUI resets requires modifying listener-level SSL configurations or embedding persistent vhost include rules.

Quick Fix

Append the enableHttp2 1 directive directly to the global HTTPS listener block in the main OpenLiteSpeed configuration file, ensuring all associated secondary vhosts negotiate HTTP/2 globally without touching individual CyberPanel vhost files:

sed -i '/listener SSL {/a \  enableHttp2                 1' /usr/local/lsws/conf/httpd_config.conf && /usr/local/lsws/bin/lswsctrl restart

Step-by-Step Resolution

1. Locate the OpenLiteSpeed Listener Configuration

Open the primary OLS server configuration file where global SSL listeners are defined.

sudo nano /usr/local/lsws/conf/httpd_config.conf

2. Configure Global HTTP/2 and HTTP/3 Protocol Support

Navigate to the listener SSL (port 443) block. Ensure that enableHttp2 and protocol negotiation settings are explicitly enabled at the listener level rather than inside volatile vhost blocks.

listener SSL {
  address                 *:443
  secure                  1
  keyFile                 /usr/local/lsws/admin/conf/webadmin.key
  certFile                /usr/local/lsws/admin/conf/webadmin.crt
  enableHttp2             1
  enableHttp3             1
  alpn                    h2, http/1.1
}

3. Implement persistent vhost-level overrides (Optional)

If a specific secondary domain requires explicit HTTP/2 rules that survive CyberPanel GUI rewrites, place the directive inside an external vhost include file rather than editing /usr/local/lsws/conf/vhosts//vhost.conf directly.

Create a custom include file:

mkdir -p /usr/local/lsws/conf/vhosts/sub.example.com/includes/
nano /usr/local/lsws/conf/vhosts/sub.example.com/includes/http2.conf

Add the protocol configuration:

enableHttp2 1
enableSpdy 0

Include the file at the bottom of the main vhost file (/usr/local/lsws/conf/vhosts/[sub.example.com/vhost.conf](https://sub.example.com/vhost.conf)):

include /usr/local/lsws/conf/vhosts/sub.example.com/includes/*.conf

CyberPanel’s GUI template parser respects existing include lines and will preserve external include file paths during domain updates.

4. Validate Configuration Syntax and Gracefully Restart

Check for configuration errors and restart the OpenLiteSpeed service to apply the protocol updates.

/usr/local/lsws/bin/lswsctrl test
/usr/local/lsws/bin/lswsctrl restart

5. Verify HTTP/2 ALPN Negotiation

Confirm that the secondary domain successfully negotiates HTTP/2 over TLS using curl.

curl -I --http2 -s https://sub.example.com | head -n 1

*Expected output: HTTP/2 200*

Why This Fails for Some Users

Missing SSL/TLS Certificates: HTTP/2 over TCP (h2) strictly requires ALPN negotiation during the TLS handshake. If a secondary domain lacks a valid SSL certificate or runs over plain HTTP (port 80), browsers and curl will automatically fall back to HTTP/1.1 regardless of enableHttp2 settings.
CyberPanel SSL Renewal Overwrites: Issuing or renewing Let’s Encrypt certificates directly from the CyberPanel GUI triggers a full rewrite of the virtual host configuration file from Python template generators (/usr/local/CyberCP/plugiN/vhost_template), wiping inline custom directives that were not wrapped in external include files.
Older OpenLiteSpeed Build Limits: OpenLiteSpeed versions prior to 1.6.x require OpenSSL 1.1.1+ compiled with ALPN support (TLSEXT_TYPE_application_layer_protocol_negotiation). On older legacy Linux distributions (e.g., CentOS 7), outdated system OpenSSL libraries cause ALPN negotiation to fail silently.
Cloudflare or Reverse Proxy Buffering: If the secondary domain routes traffic through an edge proxy (such as Cloudflare or an upstream Nginx instance), the client-to-proxy connection may display HTTP/2 while the proxy-to-CyberPanel backend connection falls back to HTTP/1.1 if edge-to-origin HTTP/2 is disabled in the proxy dashboard.