HTTP/3 on nginx only sticks if UDP 443 is open end-to-end and the Alt-Svc header is actually served. After enable I verify with curl --http3 and a browser net panel; if clients never upgrade, it is usually a firewall or missing quic listen, not the TLS cert.