All Packages / nginx-ech

How to install nginx-ech on AlmaLinux, Rocky Linux, Oracle Linux and RHEL

Encrypted Client Hello key management for NGINX

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule. The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Built for AlmaLinux, Rocky Linux, Oracle Linux and RHEL.

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install nginx-ech

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install https://epel.cloud/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum -y install nginx-ech

Frequently asked questions

How do I install nginx-ech on AlmaLinux, Rocky Linux, Oracle Linux and RHEL?

Add the GetPageSpeed repository, then install the nginx-ech package with your system package manager.

Which Enterprise Linux versions is nginx-ech available for?

nginx-ech is available for RHEL 7, 8, 9, 10.

Subscribe