How to install freenginx-ech in CentOS/RHEL 10 (x86_64)

Encrypted Client Hello key management for NGINX

License: BSD Vendor: GetPageSpeed LLC https://nginx.org/

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --enable getpagespeed-freenginx-mainline
sudo dnf -y install freenginx-ech

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule. The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Package	Size	Built	Changes
freenginx-ech-1.31.5-76.el10.gps.x86_64	26 KiB	2026-11-01	Danila Vershinin - Bump bundled nginx-module-gps-license 1.11.0 -> 1.12.0: the license · token is now read once by the root master process before workers fork, · so /etc/getpagespeed/license.jwt can be root-only (chmod 600); token · rotation still lands on reload. A missing token now logs exactly one · actionable warning instead of duplicate [error] lines
freenginx-ech-1.31.5-75.el10.gps.x86_64	26 KiB	2026-10-29	Danila Vershinin - Bump bundled nginx-module-gps-license 1.10.0 -> 1.11.0: the default · license token lookup now tries the canonical · /etc/getpagespeed/license.jwt first (one file licenses every · GetPageSpeed product on the host), then the legacy · /etc/nginx/license.jwt, which keeps working forever; an explicit · gps_license_token still wins
freenginx-ech-1.31.5-74.el10.gps.x86_64	25 KiB	2026-10-28	Danila Vershinin - Bump bundled nginx-module-gps-license 1.9.1 -> 1.10.0: the 503 page · button label is now reason-aware (missing="Set up your token", · expired="Renew license", invalid="Fix your token", revoked="Restart · subscription") and its URL carries ?ref=nginx503 so landing-page · analytics can attribute 503-driven arrivals.
freenginx-ech-1.31.4-74.el10.gps.x86_64	25 KiB	2026-10-17	Danila Vershinin - Bump bundled nginx-module-gps-license 1.9.1 -> 1.10.0: the 503 page · button label is now reason-aware (missing="Set up your token", · expired="Renew license", invalid="Fix your token", revoked="Restart · subscription") and its URL carries ?ref=nginx503 so landing-page · analytics can attribute 503-driven arrivals.
freenginx-ech-1.31.4-73.el10.gps.x86_64	25 KiB	2026-10-13	Danila Vershinin - Add freenginx-rebased copy of the QUIC BPF reload/upgrade patch; the · nginx.org version failed prep on freenginx branches (divergent sockmap · declaration and generated BPF code), breaking all 18 freenginx-mainline · CI lanes
freenginx-ech-1.31.4-69.el10.gps.x86_64	22 KiB	2026-09-18	Danila Vershinin - SELinux: allow httpd_t setattr on /dev/null (nginx-gps policy 1.2). With · the common "error_log /dev/null;" idiom, every logrotate USR1 log reopen · produced a daily [emerg] "chown(/dev/null) failed (13: Permission denied)" · because the master chowns error logs to the worker UID and the stock · policy denies it silently (dontaudit, no AVC). · - SELinux: ship nginx-gps as version-agnostic CIL text instead of a binary · .pp. The .pp module format tracks the build chroot's checkpolicy (3.10 · emits format 24), which targets one userland update behind (libsepol 3.9, · reads 4-23) cannot parse — the module then silently failed to install. · - SELinux: %post now emits a warning to stderr when the nginx-gps module · fails to install instead of swallowing the error.