Customer Advisory: HTTP/3 Enablement Across Qualys SCP Platforms to Enhance Performance and Reliability

Is This a Breaking Change?
What is the Recommended Action?
Frequently Asked Questions (FAQs)

As part of our ongoing efforts to enhance performance and modernize our infrastructure, Qualys will be introducing HTTP/3 across all Qualys SCP (Shared Cloud Platform) platforms.

HTTP/3 will be enabled in addition to the existing HTTP/1.1 and HTTP/2 protocols; it does not replace them. Qualys platform URLs will negotiate HTTP/3 with clients that support it; any client or network that cannot use HTTP/3 will continue to connect exactly as it does today.

We have revised the schedule for select PODs to allow for additional validation. PODs not listed below have been completed on their original dates.

POD	Date
EU POD 03	04-Nov-2026
KSA POD 01	04-Nov-2026
AE POD 01	05-Nov-2026
AU POD 01	05-Nov-2026
UK POD 01	06-Nov-2026
US POD 05	06-Nov-2026
IN POD 01	05-Nov-2026
EU POD 02	12-Nov-2026
EU POD 01	12-Nov-2026
US POD 04	20-Nov-2026
US POD 03	24-Nov-2026
US POD 02	24-Nov-2026
US POD 01	25-Nov-2026
US GOV1	25-Nov-2026

Is This a Breaking Change?

No. This is explicitly not a breaking change.

If you take no action:

Your UI, API, Scanner Appliance, and Cloud Agent traffic will continue to work exactly as it does today, over HTTP/2 (or HTTP/1.1 as applicable).

You will not receive the connection-speed and latency benefits of HTTP/3 until UDP/443 is permitted for the relevant Qualys URLs.

What is the Recommended Action?

If your organization wants to take advantage of HTTP/3 as soon as it’s available on your POD:

Confirm with your network/security team whether outbound UDP is currently blocked by default for HTTPS traffic.

Permit outbound UDP/443 to your Qualys platform URLs alongside your existing TCP/443 allowance – do not remove or replace the TCP/443 rule.

Frequently Asked Questions (FAQs)

Will HTTP/3 replace HTTP/1.1 or HTTP/2?

No. HTTP/3 is implemented alongside the existing HTTP/1.1 and HTTP/2 protocols. All three remain available; the client and server negotiate the best available option per connection.

Do I need to make any changes?

No changes are required for continued service. If you want to benefit from HTTP/3’s performance improvements as soon as it’s available, permit outbound UDP/443 to the relevant Qualys platform URLs alongside your existing TCP/443 rule.

What happens if I don’t update my firewall rules?

Nothing breaks. Your connections will continue over HTTP/2 (or HTTP/1.1) via the existing TCP/443 path, exactly as they do today. You simply won’t see the HTTP/3 performance benefit until UDP/443 is permitted.

Does this affect Cloud Agents, Scanner Appliances, and API/integration traffic, or just browser access to the UI?

The same negotiation logic applies across all components that connect to the Qualys platform URLs, UI, API, Scanner Appliances, Cloud Agents, and QGS. None require configuration changes; all continue to function over their current protocol if UDP/443 isn’t permitted.

Does HTTP/3 use TLS?

Yes. HTTP/3 runs over QUIC, which mandates TLS 1.3 for all connections; there is no non-encrypted mode.

Who do I contact with questions?

Reach out to your Technical Account Manager or raise a Qualys Support Ticket