allowed http versions mod security

I get forbidden error when I open the https version of the website

Is this a bug or should I do something manually?

ModSecurity: Access denied with code 403 (phase 2). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_30_http_policy.conf"] [line "78"] [id "960034"] [rev "2"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/2.0"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "a b c d.com"] [uri "/wink789/"] [unique_id "apEiQliJww8rVe16qDk28gABRQk"]

You could add 960034 to your global disabled rules...

Curious also why you are running OWASP CRS v2.2.9

v4.29.0 was release about 2 weeks ago.

Make sure mod_http2 is updated and disable the mod_security rule 960034 as suggests @overseer.

Check this thread to find how to update mod_http2:
https://forum.centos-webpanel.com/apache/http2-bomb-remote-dos-exploit-hits-nginx-apache-iis-envoy-and-cloudflare/

To update Apache to the latest with HTTP/2 you can see:

https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-apache-http-2-to-2-4-68-in-cwp-on-almalinux-8-9/