View this package for all CentOS/RHEL versions →

How to install nginx-mod-ech in CentOS/RHEL 8 (aarch64)

Encrypted Client Hello key management for NGINX-MOD

License: BSD Vendor: GetPageSpeed LLC https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install nginx-mod-ech

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule, plus nginx-ech-publish, which republishes the rotated ECHConfigList in the HTTPS DNS record through provider drop-in scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish). The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". Set a provider in /etc/sysconfig/nginx-ech-publish and that record is republished automatically after every rotation. ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Architecture

Optimized for aarch64 (ARM64) architecture. It can be used on AWS Graviton instances, as well as Raspberry Pi 4 and newer.

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Package	Size	Built	Changes
nginx-mod-ech-1.30.6-76.el8.gps.aarch64	37 KiB	2026-11-09	Danila Vershinin - Bump bundled nginx-module-gps-license 1.12.0 -> 1.14.0: license · degradation is now visible at default error_log levels (revoked/invalid · verdicts and escalation to hard enforcement log at error; expired, grace · and missing states and escalation to footer log at warn; healthy states · stay at notice). Enforcement mode changes from the license backend are · now logged explicitly. Includes 1.13.0 Pro-module runtime entitlement · shadow telemetry (logging + heartbeat only; enforcement unchanged)
nginx-mod-ech-1.30.6-75.el8.gps.aarch64	36 KiB	2026-11-07	Danila Vershinin - nginx-mod-ech: nginx-ech-publish publishes one HTTPS record per hostname. ECH_RECORD_NAME · now takes a list (spaces or commas), so example.com and www.example.com · both stay current on rotation; a failed name no longer hides the others · and still fails the unit.
nginx-mod-ech-1.30.6-74.el8.gps.aarch64	36 KiB	2026-11-01	Danila Vershinin - Bump bundled nginx-module-gps-license 1.11.0 -> 1.12.0: the license · token is now read once by the root master process before workers fork, · so /etc/getpagespeed/license.jwt can be root-only (chmod 600); token · rotation still lands on reload. A missing token now logs exactly one · actionable warning instead of duplicate [error] lines
nginx-mod-ech-1.30.6-73.el8.gps.aarch64	35 KiB	2026-10-29	Danila Vershinin - Bump bundled nginx-module-gps-license 1.10.0 -> 1.11.0: the default · license token lookup now tries the canonical · /etc/getpagespeed/license.jwt first (one file licenses every · GetPageSpeed product on the host), then the legacy · /etc/nginx/license.jwt, which keeps working forever; an explicit · gps_license_token still wins
nginx-mod-ech-1.30.6-72.el8.gps.aarch64	35 KiB	2026-10-17	Danila Vershinin - Bump bundled nginx-module-gps-license 1.9.1 -> 1.10.0: the 503 page · button label is now reason-aware (missing="Set up your token", · expired="Renew license", invalid="Fix your token", revoked="Restart · subscription") and its URL carries ?ref=nginx503 so landing-page · analytics can attribute 503-driven arrivals.