Package: nginx-mod-ech
Source: nginx-mod
Version: 1:1.30.6-4~gps1+ubuntu2204+stable
Architecture: arm64
Maintainer: GetPageSpeed LLC <builder@getpagespeed.com>
Installed-Size: 47
Depends: nginx-mod (= 1:1.30.6-4~gps1+ubuntu2204+stable), openssl35
Homepage: https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build
Priority: optional
Section: httpd
Filename: pool/main/n/nginx-mod/nginx-mod-ech_1.30.6-4~gps1+ubuntu2204+stable_arm64.deb
Size: 11652
SHA512: 931fb9ee695c30afdd25e9cd784d712cb5484f02b9e2ed80ee82ec9d8e801f1948d6947cb3642b7ca9fc3536324a213d6bd16e47ad811101ca287b1741bbfcf7
SHA256: f4ae0bb8642f929a20f8af3514f5f7512f476996a391284557dbd455aa80767d
SHA1: 9dbc52d06482df8d98fe34486e8ab5a7caf54dfa
MD5sum: 35eae30e16283eb9063ec7598c80f17b
Description: Encrypted Client Hello key management for nginx-mod (GetPageSpeed)
 Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
 .
 nginx reads ECH keys while parsing its configuration, so a new key only
 takes effect on reload, and a client that picked up an older ECHConfigList
 from a cached HTTPS DNS record still needs the key it encrypted to. nginx
 handles that by accepting several ssl_ech_file directives: the first is
 advertised in retry-configs, the rest stay loaded for decryption only.
 .
 This package ships nginx-ech-keygen, which maintains that rolling set under
 /etc/nginx/ech and regenerates the include listing them, plus a systemd
 timer that rotates on a schedule, plus nginx-ech-publish, which republishes
 the rotated ECHConfigList in the HTTPS DNS record through provider drop-in
 scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish).
 .
 The timer is not enabled on install and nothing happens until you configure
 it. Set ECH_PUBLIC_NAME in /etc/default/nginx-ech-rotate, run
 "nginx-ech-keygen --init", publish the value it prints in the HTTPS record
 for your ECH-enabled names, then "systemctl enable --now
 nginx-ech-rotate.timer". Set a provider in /etc/default/nginx-ech-publish
 and that record is republished automatically after every rotation.
 .
 ECH only helps if the HTTPS record is served from a DNS-only zone and
 clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/