Explain how HTTP/3 support works in Traefik and its requirements?

HTTP/3 runs over QUIC, which itself runs over UDP rather than TCP, so enabling it means an entrypoint must additionally listen for UDP traffic on the same port as its TLS-enabled TCP listener, since a client first connects over TCP/TLS and gets advertised HTTP/3 availability via an Alt-Svc header before switching.

entryPoints:
  websecure:
    address: ":443"
    http3: {}

Because QUIC encrypts virtually the entire connection, including what used to be visible handshake metadata, it has stricter TLS requirements than classic HTTP/2 or HTTP/1.1 over TLS, and unlike HTTP-01, it always requires a valid certificate to be already present since there's no unencrypted fallback path for negotiation.

Once enabled, clients that support HTTP/3 (most modern browsers) will, after their first successful HTTPS connection over TCP, upgrade subsequent connections to QUIC/UDP automatically, generally reducing connection setup latency, especially on lossy or high-latency networks where QUIC's handling of packet loss avoids TCP's head-of-line blocking.