Repository / nginx extras / nginx-module-handshake-padding

View this package for all CentOS/RHEL versions →

How to install nginx-module-handshake-padding (x86_64)

TLS 1.3 handshake record padding against ECH vhost fingerprinting

Install

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install nginx-module-handshake-padding

Description

Pads outgoing TLS 1.3 handshake records to a multiple of a configured block size, so that virtual hosts sharing an ECH (Encrypted Client Hello) listener cannot be told apart by the exact record sizes of their encrypted server handshake flight. This is the server-side mitigation RFC 9849 section 6.1.3 calls for: without it, a single byte of certificate difference uniquely identifies a vhost behind an ECH cover. One directive: ssl_handshake_padding (default off, recommended 512). Zero application-data overhead, KTLS-compatible; requires nginx running against OpenSSL 3.4+; HTTP/3 handshakes are not covered by the underlying OpenSSL API. To enable this module after installation, add the following to /etc/nginx/nginx.conf and reload NGINX: load_module modules/ngx_http_ssl_handshake_padding_module.so; Alternatively, enable all installed modules by adding this line to the top of /etc/nginx/nginx.conf: include /usr/share/nginx/modules/*.conf;

RPMs

Subscribe