All Packages / ea-nginx-handshake-padding

How to install ea-nginx-handshake-padding on AlmaLinux, Rocky Linux, Oracle Linux and RHEL

TLS 1.3 handshake record padding against ECH vhost fingerprinting

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Description

TLS 1.3 handshake record padding against ECH vhost fingerprinting Pads outgoing TLS 1.3 handshake records to a multiple of a configured block size, so that virtual hosts sharing an ECH (Encrypted Client Hello) listener cannot be told apart by the exact record sizes of their encrypted server handshake flight. This is the server-side mitigation RFC 9849 section 6.1.3 calls for: without it, a single byte of certificate difference uniquely identifies a vhost behind an ECH cover. One directive: ssl_handshake_padding (default off, recommended 512). Zero application-data overhead, KTLS-compatible; requires nginx running against OpenSSL 3.4+; HTTP/3 handshakes are not covered by the underlying OpenSSL API. This module is built for cPanel EasyApache 4 (EA4) nginx compatibility.

Built for AlmaLinux, Rocky Linux, Oracle Linux and RHEL.

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install ea-nginx-handshake-padding

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install https://epel.cloud/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum -y install ea-nginx-handshake-padding

Frequently asked questions

How do I install ea-nginx-handshake-padding on AlmaLinux, Rocky Linux, Oracle Linux and RHEL?

Add the GetPageSpeed repository, then install the ea-nginx-handshake-padding package with your system package manager.

Which Enterprise Linux versions is ea-nginx-handshake-padding available for?

ea-nginx-handshake-padding is available for RHEL 7, 8, 9.

Subscribe