All Packages / nginx-ech

How to install nginx-ech on SUSE Linux Enterprise

Encrypted Client Hello key management for NGINX

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule. The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Built for SUSE Linux Enterprise.

Install

sudo zypper --non-interactive install https://extras.getpagespeed.com/release-latest.rpm
sudo zypper --non-interactive install nginx-ech

sudo zypper --non-interactive install https://extras.getpagespeed.com/release-latest.rpm
sudo zypper modifyrepo --enable getpagespeed-extras-mainline
sudo zypper --non-interactive install nginx-ech

Frequently asked questions

How do I install nginx-ech on SUSE Linux Enterprise?

Add the GetPageSpeed repository, then install the nginx-ech package with your system package manager.

Which SUSE Linux Enterprise versions is nginx-ech available for?

nginx-ech is available for SLES 16.

Subscribe