4 ms·
That means one-site-per-IP, which doesn't work with the way we currently do L3->L5.
by parliament32 6y ago
That means one-site-per-IP, which doesn't work with the way we currently do L3->L5.
- johncolanduoni 6y agoOne-site-per-IP also ruins much of the point of ESNI, since then anyone who wants to block or track what domain you are visiting can just lookup the domains they’re interested in and match them to IP addresses.
- corty 6y agoFor the most part they can do that anyways, ESNI or ECH are only relevant for big hosters or proxy services.
- corty 6y agono, the per-ip key is just the one you would use for ECH, in the encrypted part you can use separate per-vhost certificates as usual
- namibj 6y agoNo, this is just a way to verify the Cert for the first handshake, so that one doesn't need to use one with the IP in the sub alt names.