How to install nginx-mod-ech in CentOS/RHEL 8 (x86_64)

Encrypted Client Hello key management for NGINX-MOD

License: BSD Vendor: GetPageSpeed LLC https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --enable getpagespeed-extras-nginx-mod
sudo dnf -y install nginx-mod-ech

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule, plus nginx-ech-publish, which republishes the rotated ECHConfigList in the HTTPS DNS record through provider drop-in scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish). The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". Set a provider in /etc/sysconfig/nginx-ech-publish and that record is republished automatically after every rotation. ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Package	Size	Built	Changes
nginx-mod-ech-1.30.4-66.el8.gps.x86_64	31 KiB	2026-09-09	Danila Vershinin - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new · default-off boolean. The stock policy grants httpd_t nothing on the bpf · class, so enabling quic_bpf made nginx refuse to start with "failed to · create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds · the empirically-captured allows (bpf map/prog permissions plus the bpf, · perfmon and net_admin capability checks), all gated behind the boolean · nginx_quic_bpf, off by default: nothing changes for any install until · "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: · start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; · with the boolean off, behavior is exactly as before.
nginx-mod-ech-1.30.4-65.el8.gps.x86_64	30 KiB	2026-09-07	Danila Vershinin - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity · probe request and every hard-enforcement 503 left one worker connection · un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min · monitoring probe could take a server down in about a day (reported by an · Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both · paths now finalize the request; hard 503s appear in access_log, probe · requests remain unlogged. Regression-tested (integration + EL9 e2e with · the reporter's exact ss check) and E2E-proven against production. · - tests: harden the limit_req nano-units equivalence check against slow · builders (issue the whole burst window from one curl process); it · failed 3/3 retries on el10-aarch64 in the Release 64 build, which this · Release 65 supersedes. Also fix the changelog weekday.
nginx-mod-ech-1.30.4-64.el8.gps.x86_64	30 KiB	2026-09-07	Danila Vershinin - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity · probe request and every hard-enforcement 503 left one worker connection · un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min · monitoring probe could take a server down in about a day (reported by an · Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both · paths now finalize the request; hard 503s appear in access_log, probe · requests remain unlogged. Regression-tested (integration + EL9 e2e with · the reporter's exact ss check) and E2E-proven against production.
nginx-mod-ech-1.30.4-63.el8.gps.x86_64	29 KiB	2026-09-03	Danila Vershinin - gps-license 1.9.0 tarball refresh: fix Linux compilation of the module's · unit-test harness (POSIX feature-test macro, test path buffer); shipped · module code unchanged. Supersedes the partially-published Release 62 · (x86_64-only, cancelled mid-build) so all architectures converge on the · E2E-proven build (verified against production: beacon machine identity · row landed in repo_license_usage)
nginx-mod-ech-1.30.4-62.el8.gps.x86_64	29 KiB	2026-09-03	Danila Vershinin - gps-license module 1.9.0: privacy-preserving machine identity in the usage · beacon (salted-hash machine_id/dmi_id/mac_id + id_src; raw identifiers never · leave the machine) and deterministic per-machine report jitter so · config-management-synced fleets stop burst-POSTing · - includes previously unvendored 1.8.0: sticky-REVOKED honored on explicit · server status, throttled WARN on silent DNS/TLS egress failures with signed · offline_allowed suppression for air-gapped Enterprise, timer-path DNS · re-resolve with backoff
nginx-mod-ech-1.30.4-61.el8.gps.x86_64	28 KiB	2026-08-27	Danila Vershinin - nginx-mod-ech: publish rotated keys to DNS. New nginx-ech-publish runs as · the second ExecStart of nginx-ech-rotate.service, so after every successful · rotation the HTTPS record is republished instead of going stale (stale · records silently downgrade every first visit to the retry-config path). · Provider-agnostic: drop-in provider scripts under libexec, Cloudflare · shipped first, configured via /etc/sysconfig/nginx-ech-publish and inert · until a provider is set. The cloudflare provider reuses certbot's · /root/.cloudflare.ini and treats a failed record lookup as a hard error, · never as "no record exists", so it cannot create duplicate HTTPS records.
nginx-mod-ech-1.30.4-60.el8.gps.x86_64	24 KiB	2026-08-26	Danila Vershinin - nginx-mod-ech: roll the generated include back when "nginx -t" fails during · a rotation. Previously a rotation that tripped over an unrelated config · error left the new include committed, so the configuration stayed · unloadable and the next reload by anything else (logrotate, a certificate · renewal) failed too. Now the include is restored and nothing is reloaded.