How to install nginx-ech in CentOS/RHEL 9 (x86_64)

Encrypted Client Hello key management for NGINX

License: BSD Vendor: GetPageSpeed LLC https://nginx.org/

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --enable getpagespeed-extras-testing
sudo dnf -y install nginx-ech

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule. The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Package	Size	Built	Changes
nginx-ech-1.30.4-65.el9.gps.x86_64	19 KiB	2026-09-09	Danila Vershinin - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new · default-off boolean. The stock policy grants httpd_t nothing on the bpf · class, so enabling quic_bpf made nginx refuse to start with "failed to · create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds · the empirically-captured allows (bpf map/prog permissions plus the bpf, · perfmon and net_admin capability checks), all gated behind the boolean · nginx_quic_bpf, off by default: nothing changes for any install until · "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: · start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; · with the boolean off, behavior is exactly as before.
nginx-ech-1.30.4-64.el9.gps.x86_64	19 KiB	2026-08-26	Danila Vershinin - nginx-ech: new subpackage for ECH (RFC 9849) key generation and rotation, · at parity with nginx-mod-ech (shared nginx-ech-keygen implementation) · - assert ECH is live at build time: a bogus ssl_ech_file must fail the · configuration test instead of degrading to a silent no-op