Package: nginx-mod-ech
Source: nginx-mod
Version: 1:1.30.6-4~gps1+ubuntu2404+stable
Architecture: arm64
Maintainer: GetPageSpeed LLC <builder@getpagespeed.com>
Installed-Size: 47
Depends: nginx-mod (= 1:1.30.6-4~gps1+ubuntu2404+stable), openssl35
Homepage: https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build
Priority: optional
Section: httpd
Filename: pool/main/n/nginx-mod/nginx-mod-ech_1.30.6-4~gps1+ubuntu2404+stable_arm64.deb
Size: 11652
SHA512: 7b5828e4e59aae42c4d2c02b9f6b630b99459d056fa4d9e2df378df00e87edd7c6a99fadc1cddcf7f49d6f12570deb350bb8509753e14cc17e39fc25c13a4825
SHA256: 6b5ef90a4eaae87d5dec35ab975077bad84bbd43262a6615d0a609145df42fcc
SHA1: d09688a91b9a6ccab0f86cc4dc13fbc80318cfa2
MD5sum: cb1ac0e7f96197ef166506ff7b73e90e
Description: Encrypted Client Hello key management for nginx-mod (GetPageSpeed)
 Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849).
 .
 nginx reads ECH keys while parsing its configuration, so a new key only
 takes effect on reload, and a client that picked up an older ECHConfigList
 from a cached HTTPS DNS record still needs the key it encrypted to. nginx
 handles that by accepting several ssl_ech_file directives: the first is
 advertised in retry-configs, the rest stay loaded for decryption only.
 .
 This package ships nginx-ech-keygen, which maintains that rolling set under
 /etc/nginx/ech and regenerates the include listing them, plus a systemd
 timer that rotates on a schedule, plus nginx-ech-publish, which republishes
 the rotated ECHConfigList in the HTTPS DNS record through provider drop-in
 scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish).
 .
 The timer is not enabled on install and nothing happens until you configure
 it. Set ECH_PUBLIC_NAME in /etc/default/nginx-ech-rotate, run
 "nginx-ech-keygen --init", publish the value it prints in the HTTPS record
 for your ECH-enabled names, then "systemctl enable --now
 nginx-ech-rotate.timer". Set a provider in /etc/default/nginx-ech-publish
 and that record is republished automatically after every rotation.
 .
 ECH only helps if the HTTPS record is served from a DNS-only zone and
 clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/