3 ms·
From my understanding, the router would need to terminate tls to read the SNI with ECH and at that point you might as well use the Host HTTP header for HTTP.
by Kab1r 4y ago
From my understanding, the router would need to terminate tls to read the SNI with ECH and at that point you might as well use the Host HTTP header for HTTP.
- anderspitman 4y agoECH is encrypted using a public key obtained through DNS (specifically DNS-over-HTTPS[0]). My assumption is that you would terminate the ECH encryption at the edge, but everything else can be terminated with a separate cert at the origin server. But I would be interested to know what deployment looks like in practice. [0]: https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/