How to install nginx-mod-ech on Fedora Linux

Encrypted Client Hello key management for NGINX-MOD

License: BSD Vendor: GetPageSpeed LLC https://www.getpagespeed.com/server-setup/nginx-mod-a-better-faster-nginx-build

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Distro	Channel	aarch64	x86_64	Version
Fedora 44	NGINX-MOD			1.30.6
Fedora 43	NGINX-MOD			1.30.6

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule, plus nginx-ech-publish, which republishes the rotated ECHConfigList in the HTTPS DNS record through provider drop-in scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish). The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". Set a provider in /etc/sysconfig/nginx-ech-publish and that record is republished automatically after every rotation. ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Built for Fedora Linux.

Install

NGINX-MOD Fedora 43, 44

nginx-mod-ech on Fedora Linux 43, 44

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --enable getpagespeed-extras-nginx-mod
sudo dnf -y install nginx-mod-ech

Frequently asked questions

How do I install nginx-mod-ech on Fedora Linux?

Add the GetPageSpeed repository, then install the nginx-mod-ech package with your system package manager.

Which Fedora Linux versions is nginx-mod-ech available for?

nginx-mod-ech is available for Fedora 43, 44.