GetPageSpeed Extras

How to install nginx-module-handshake-padding on Ubuntu

TLS 1.3 handshake record padding against ECH vhost fingerprinting

Vendor: GetPageSpeed https://github.com/GetPageSpeed/ngx_ssl_handshake_padding

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Distro Channel amd64 arm64 Version
Ubuntu 26.04 (resolute) Stable 1.30.6+1.0.0
NGINX mainline 1.31.8+1.0.0
Ubuntu 24.04 (noble) Stable 1.30.6+1.0.0
NGINX mainline 1.31.8+1.0.0
Ubuntu 22.04 (jammy) Stable 1.30.6+1.0.0
NGINX mainline 1.31.8+1.0.0
Ubuntu 20.04 (focal) Stable 1.30.6+1.0.0
NGINX mainline 1.31.8+1.0.0

Description

Pads outgoing TLS 1.3 handshake records to a multiple of a configured block size, so that virtual hosts sharing an ECH (Encrypted Client Hello) listener cannot be told apart by the exact record sizes of their encrypted server handshake flight. This is the server-side mitigation RFC 9849 section 6.1.3 calls for: without it, a single byte of certificate difference uniquely identifies a vhost behind an ECH cover. One directive: ssl_handshake_padding (default off, recommended 512). Zero application-data overhead, KTLS-compatible; requires nginx running against OpenSSL 3.4+; HTTP/3 handshakes are not covered by the underlying OpenSSL API.

Built for Ubuntu.

Install

Stable Ubuntu 20.04, 22.04, 24.04, 26.04

nginx-module-handshake-padding on Ubuntu 20.04 (focal), 22.04 (jammy), 24.04 (noble), 26.04 (resolute)

curl -fsSL https://extras.getpagespeed.com/release-latest.deb -o /tmp/getpagespeed-release.deb
sudo apt-get install -y /tmp/getpagespeed-release.deb
rm /tmp/getpagespeed-release.deb
sudo apt-get update
sudo apt-get install -y nginx-module-handshake-padding
NGINX mainline Ubuntu 20.04, 22.04, 24.04, 26.04

nginx-module-handshake-padding on Ubuntu 20.04 (focal), 22.04 (jammy), 24.04 (noble), 26.04 (resolute)

curl -fsSL https://extras.getpagespeed.com/release-latest.deb -o /tmp/getpagespeed-release.deb
sudo apt-get install -y /tmp/getpagespeed-release.deb
rm /tmp/getpagespeed-release.deb
sudo getpagespeed-extras-channel mainline
sudo apt-get update
sudo apt-get install -y nginx-module-handshake-padding

Package downloads require an active GetPageSpeed subscription — one repository for nginx-module-handshake-padding and thousands more packages for Ubuntu.

Subscribe — from $10/mo

Other releases and channels: use the setup wizard.

Frequently asked questions

How do I install nginx-module-handshake-padding on Ubuntu?

Add the GetPageSpeed repository, then install the nginx-module-handshake-padding package with your system package manager.

Which Ubuntu versions is nginx-module-handshake-padding available for?

nginx-module-handshake-padding is available for Ubuntu 20.04, 22.04, 24.04, 26.04.

Subscribe