How to install nginx-mod-ech on Debian

Encrypted Client Hello key management for nginx-mod (GetPageSpeed)

Vendor: GetPageSpeed LLC https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Distro	Channel	amd64	arm64	Version
Debian 12 (bookworm)	NGINX-MOD			1.30.6

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule, plus nginx-ech-publish, which republishes the rotated ECHConfigList in the HTTPS DNS record through provider drop-in scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish). The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/default/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". Set a provider in /etc/default/nginx-ech-publish and that record is republished automatically after every rotation. ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Built for Debian.

Install

NGINX-MOD Debian 12

nginx-mod-ech on Debian 12 (bookworm)

curl -fsSL https://extras.getpagespeed.com/release-latest.deb -o /tmp/getpagespeed-release.deb
sudo apt-get install -y /tmp/getpagespeed-release.deb
rm /tmp/getpagespeed-release.deb
sudo getpagespeed-extras-channel nginx-mod
sudo apt-get update
sudo apt-get install -y nginx-mod-ech

Frequently asked questions

How do I install nginx-mod-ech on Debian?

Add the GetPageSpeed repository, then install the nginx-mod-ech package with your system package manager.

Which Debian versions is nginx-mod-ech available for?

nginx-mod-ech is available for Debian 12.