Repository / Letter S / sw-nginx-module-handshake-padding

How to install sw-nginx-module-handshake-padding in CentOS/RHEL 9 (x86_64)

TLS 1.3 handshake record padding against ECH vhost fingerprinting

Important: The Plesk control panel must be installed on your server before using this repository.

Install

# The Plesk control panel must be installed on your server.
sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --enable getpagespeed-extras-plesk
sudo dnf -y install sw-nginx-module-handshake-padding

Description

Pads outgoing TLS 1.3 handshake records to a multiple of a configured block size, so that virtual hosts sharing an ECH (Encrypted Client Hello) listener cannot be told apart by the exact record sizes of their encrypted server handshake flight. This is the server-side mitigation RFC 9849 section 6.1.3 calls for: without it, a single byte of certificate difference uniquely identifies a vhost behind an ECH cover. One directive: ssl_handshake_padding (default off, recommended 512). Zero application-data overhead, KTLS-compatible; requires nginx running against OpenSSL 3.4+; HTTP/3 handshakes are not covered by the underlying OpenSSL API. After installation, enable this module by running: plesk sbin nginx_modules_ctl --enable handshake-padding

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Subscribe