RFC 9849. TLS Encrypted Client Hello

#1

Post by P_qRs » Wed, Mar 04, 2026, 7:25 AM UTC

RFC 9849. TLS Encrypted Client Hello
rfc-editor.org

Re: RFC 9849. TLS Encrypted Client Hello

#2

Post by weitzj » Wed, Mar 04, 2026, 8:16 AM UTC

Will this have an impact on Loadbalancers? Like does one have to do client side load balancing like in gRPC?

Re: RFC 9849. TLS Encrypted Client Hello

#3

Post by [deleted] » Wed, Mar 04, 2026, 8:26 AM UTC

weitzj wrote: post #2

Will this have an impact on Loadbalancers? Like does one have to do client side load balancing like in gRPC?

[deleted]

Re: RFC 9849. TLS Encrypted Client Hello

#4

Post by ivanr » Wed, Mar 04, 2026, 8:26 AM UTC

I wrote about ECH a couple of months ago, when the specs were still in draft but already approved for publication. It's a short read, if you're not already familiar with ECH and its history: https://www.feistyduck.com/newsletter/issue_127_encrypted_cl...

In addition to the main RFC 9849, there is also RFC 9848 - "Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings": https://datatracker.ietf.org/doc/rfc9848/

There's an example of how it's used in the article.

Re: RFC 9849. TLS Encrypted Client Hello

#5

Post by j16sdiz » Wed, Mar 04, 2026, 8:37 AM UTC

weitzj wrote: post #2

Will this have an impact on Loadbalancers? Like does one have to do client side load balancing like in gRPC?

The loadbalancer can force a downgrade .

Re: RFC 9849. TLS Encrypted Client Hello

#6

Post by grenran » Wed, Mar 04, 2026, 8:53 AM UTC

weitzj wrote: post #2

Will this have an impact on Loadbalancers? Like does one have to do client side load balancing like in gRPC?

My understanding is that you can use split mode to only have the load balancer decrypt the server name section, and forward the actual session and key exchange down to the backend without doing double layer encryption.

Re: RFC 9849. TLS Encrypted Client Hello

#7

Post by fmajid » Wed, Mar 04, 2026, 9:02 AM UTC

ivanr wrote: post #4

I wrote about ECH a couple of months ago, when the specs were still in draft but already approved for publication. It's a short read, if you're not already familiar with ECH and its history: https://www.feistyduck.com/newsletter/issue_127_encrypted_cl... In addition to the main RFC 9849, there is also RFC 9848 - "Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings": https://datatracker.ietf.org/doc/rfc9…

Thanks for the writeup, Ivan, I am a great fan of your work!

Now we need to get Qualys to cap SSL Labs ratings at B for servers that don't support ECH. Also those that don't have HSTS and HSTS Preload while we're at it.

Re: RFC 9849. TLS Encrypted Client Hello

#8

Post by micw » Wed, Mar 04, 2026, 9:07 AM UTC

j16sdiz wrote: post #5

weitzj wrote: post #2

Will this have an impact on Loadbalancers? Like does one have to do client side load balancing like in gRPC?

The loadbalancer can force a downgrade .

If the load balancer can force a downgrade, an attacker can do it as well.

Re: RFC 9849. TLS Encrypted Client Hello

#9

Post by [deleted] » Wed, Mar 04, 2026, 9:11 AM UTC

[deleted]

Re: RFC 9849. TLS Encrypted Client Hello

#10

Post by ivanr » Wed, Mar 04, 2026, 9:13 AM UTC

fmajid wrote: post #7

ivanr wrote: post #4

I wrote about ECH a couple of months ago, when the specs were still in draft but already approved for publication. It's a short read, if you're not already familiar with ECH and its history: https://www.feistyduck.com/newsletter/issue_127_encrypted_cl... In addition to the main RFC 9849, there is also RFC 9848 - "Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings": https://datatracker.ietf.org/doc/rfc9…

Thanks for the writeup, Ivan, I am a great fan of your work! Now we need to get Qualys to cap SSL Labs ratings at B for servers that don't support ECH. Also those that don't have HSTS and HSTS Preload while we're at it.

Thanks! Sadly, SSL Labs doesn't appear to be actively maintained. I've noticed increasing gaps in its coverage and inspection quality. I left quite a while ago (2016) and can't influence its grading any more, sadly.