4 ms·
Encrypted Client Hello? Or are you referring to other metadata?
by anderspitman 4y ago
Encrypted Client Hello? Or are you referring to other metadata?
- Kab1r 4y agoFrom my understanding, the router would need to terminate tls to read the SNI with ECH and at that point you might as well use the Host HTTP header for HTTP.
- anderspitman 4y agoECH is encrypted using a public key obtained through DNS (specifically DNS-over-HTTPS[0]). My assumption is that you would terminate the ECH encryption at the edge, but everything else can be terminated with a separate cert at the origin server. But I would be interested to know what deployment looks like in practice. [0]: https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/