Subject: [TLS] ECH-10 interop test server

From: Christopher Patton <[email-masked]>
Date: Mon, 5 Apr 2021 10:01:56 -0700

Hi list, just FYI that Cloudflare's test server is upgrading to
draft-ietf-tls-esni-10 this morning. It should finish rolling out in a few
hours. Note that we've dropped support for draft-ietf-tls-esni-09.

The endpoint is https://crypto.cloudflare.com. You'll also find our ECH
config in the HTTPS resource record.

Best,
Chris P.

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 5 Apr 2021 18:07:09 +0100

Hiya,

> config in the HTTPS resource record.

Good stuff. I have a client that thinks it's ready to go but
we'll see:-)

I also have an openssl s_server running on port 8410 at
draft-10.esni.defo.ie with an ECHConfig published in the DNS
for that. It's probably v. fragile, so likely best to contact
me if playing with it. That works with my draft-10 openssl
s_client and with a build of curl using my fork of the
openssl library.

Cheers,
S.

> 
> Best,
> Chris P.
> 
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 7 Apr 2021 22:47:56 +0100

Hiya,

> Good stuff. I have a client that thinks it's ready to go but

Well, surprisingly for me, that appears to have "just worked"
with no change to my draft-10 clients (neither s_client nor
curl).

(In case it helps someone else...) Is there any way that the
HTTP response content could differ if ECH succeeded or not?
I'm seeing the same 302 response in either case I think but
maybe there's some specific pathname or something that'd
result in different HTTP responses?

Thanks,
S.

---

From: Christopher Patton <[email-masked]>
Date: Wed, 7 Apr 2021 15:09:22 -0700

> result in different HTTP responses?

That's right, we're just redirecting most HTTP requests to the spec right
now.

---

From: Rob Sayre <[email-masked]>
Date: Wed, 7 Apr 2021 15:11:42 -0700

> That's right, we're just redirecting most HTTP requests to the spec right

FWIW, I found this confusing as well. I'd expect a 200 "It worked!"
response if ECH interoperated.

thanks,
Rob

---

From: Christopher Patton <[email-masked]>
Date: Wed, 7 Apr 2021 15:13:54 -0700

Yup, we she it add this. Just so you know, the buck stops with me here :)
I've been meaning to build an ECH status page but haven't gotten around to
it.

---

From: Rob Sayre <[email-masked]>
Date: Wed, 7 Apr 2021 15:19:42 -0700

> I've been meaning to build an ECH status page but haven't gotten around to

No sweat. Thanks for operating the test server in the first place.

thanks,
Rob