HTTP/2 Negotiation with a Proxy and Its Destination
curl's --proxy-http2 controls the HTTPS proxy connection. The destination inside a tunnel negotiates its own HTTP version.
The website can answer HTTP/2 through an HTTP/1.1 CONNECT tunnel. Its TLS session negotiates the destination protocol independently of the client-to-proxy connection. The reverse also holds: HTTP/2 to an HTTPS proxy does not force HTTP/2 at the website.
To test the outer connection deliberately, curl 8.1.0 added --proxy-http2:
curl --proxy https://proxy.example:8443 --proxy-http2 --connect-timeout 5 --max-time 15 --verbose https://example.com/Use a real HTTPS proxy and an HTTP/2-capable curl build. Check curl --version, then read the verbose negotiation: the proxy can offer only HTTP/1, which curl will use. The flag does not enable HTTP/2 on a plain HTTP or SOCKS listener.
Record proxy negotiation separately from the final transfer's HTTP version. A response version or final-transfer write-out value does not automatically describe the outer proxy connection.
For an endpoint from the public HTTP proxy list, start with its supported transport and a complete request. Add this option when you actually have an HTTPS proxy and want to test that outer capability, rather than because the website supports HTTP/2. Even two proxies reaching the same HTTP/2 site can differ in routing, load and setup time; the website version alone cannot explain performance.