Package: nginx-mod-ech
Source: nginx-mod
Version: 1:1.30.6-4~gps1+ubuntu2404+stable
Architecture: amd64
Maintainer: GetPageSpeed LLC <builder@getpagespeed.com>
Installed-Size: 47
Depends: nginx-mod (= 1:1.30.6-4~gps1+ubuntu2404+stable), openssl35
Homepage: https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build
Priority: optional
Section: httpd
Filename: pool/main/n/nginx-mod/nginx-mod-ech_1.30.6-4~gps1+ubuntu2404+stable_amd64.deb
Size: 11652
SHA512: 195cd658e0ad388bd9755b37826135f9e01b5e1ccc2bbe603f85404d82bc433a1d9b9e1204f265cbb104e3e9366e03fbbff328b80de91c2e9bea96dcaaefa324
SHA256: c2a2dca5f11016f392e579995cae3265ef57da9c95ec8f9ebdb5907a724c2bf9
SHA1: 465529532ac314d4fb9b643269004030fbffe552
MD5sum: 561f0e4be993ede3f4ed92db7650efb0
Description: Encrypted Client Hello key management for nginx-mod (GetPageSpeed)
 Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
 .
 nginx reads ECH keys while parsing its configuration, so a new key only
 takes effect on reload, and a client that picked up an older ECHConfigList
 from a cached HTTPS DNS record still needs the key it encrypted to. nginx
 handles that by accepting several ssl_ech_file directives: the first is
 advertised in retry-configs, the rest stay loaded for decryption only.
 .
 This package ships nginx-ech-keygen, which maintains that rolling set under
 /etc/nginx/ech and regenerates the include listing them, plus a systemd
 timer that rotates on a schedule, plus nginx-ech-publish, which republishes
 the rotated ECHConfigList in the HTTPS DNS record through provider drop-in
 scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish).
 .
 The timer is not enabled on install and nothing happens until you configure
 it. Set ECH_PUBLIC_NAME in /etc/default/nginx-ech-rotate, run
 "nginx-ech-keygen --init", publish the value it prints in the HTTPS record
 for your ECH-enabled names, then "systemctl enable --now
 nginx-ech-rotate.timer". Set a provider in /etc/default/nginx-ech-publish
 and that record is republished automatically after every rotation.
 .
 ECH only helps if the HTTPS record is served from a DNS-only zone and
 clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/