When configuring NGINX for secure web applications, these three forms of the listen directive represent distinct network binding behaviors:

listen 443 ssl;
listen [::]:443 ssl; 
listen [::]:443 ssl http2;

1. IPv4-only binding:
listen 443 ssl;
- Binds to all IPv4 interfaces on port 443
- Explicitly enables SSL/TLS encryption
- Won't accept IPv6 connections

2. Dual-stack IPv6 binding:
listen [::]:443 ssl;
- [::] binds to all IPv6 interfaces
- On most modern systems, this implicitly includes IPv4 through IPv6-mapped addresses
- Requires ipv6only=off parameter for explicit dual-stack support on some OS versions

3. HTTP/2 enabled binding:
listen [::]:443 ssl http2;
- Combines dual-stack binding with HTTP/2 protocol support
- Modern browsers require ALPN negotiation over HTTPS
- Maintains backward compatibility with HTTP/1.1 clients

For maximum compatibility while supporting modern protocols:

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    
    # Modern cipher suite configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers on;
    
    # HTTP/2 with fallback
    http2 on;
    
    # Certificate configuration
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    
    # ... server configuration continues
}

1. IPv4 fallback: Some older Linux kernels require explicit dual-stack configuration:
listen [::]:443 ssl ipv6only=off;

2. HTTP/2 readiness: Ensure OpenSSL 1.0.2+ for ALPN support

3. Legacy client support: Maintain separate listen 80 server block for HTTP fallback with redirect to HTTPS

# IPv4-only binding
listen 443 ssl;

# Dual-stack binding (IPv6+IPv4)
listen [::]:443 ssl;

# Dual-stack with HTTP/2
listen [::]:443 ssl http2;

server {
    # Explicit dual-stack declaration
    listen 80;
    listen [::]:80;
    
    # Secure configurations
    listen 443 ssl;
    listen [::]:443 ssl;
    
    # Modern config with HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    
    # Older clients fallback
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}

server {
    # Primary HTTPS endpoint
    listen [::]:443 ssl http2;
    
    # SSL configuration omitted for brevity
    ...
    
    # IPv4 fallback (only needed for legacy systems)
    listen 443 ssl;
}