HTTPS/SVCB records for ECH

[tahmid-23]

Hi,

this project would definitely be useful to test ECH (Encrypted ClientHello) servers. would it be possible to include ECH configurations and keys as part of this project, and add an HTTPS/SVCB record for ECH?

https://datatracker.ietf.org/doc/html/draft-ietf-tls-svcb-ech-05

Thank you!

[GloriaOS]

Great question! ECH (Encrypted ClientHello) is definitely the future of TLS privacy. Here's the reality for localhost.direct:

Why ECH is tricky here

ECH works by publishing the server's public key in DNS via an HTTPS/SVCB record with the ech parameter. The client fetches this DNS record, encrypts its ClientHello with that key, and only the server with the matching private key can decrypt it.

The problem: localhost.direct provides a pre-shared certificate bundle — the same keypair goes to every developer. For ECH to work, you'd need:

1. A unique keypair for ECH (separate from the TLS cert) published in DNS
2. That keypair distributed to every developer alongside the cert

This creates a chicken-and-egg: if you publish the ECH private key openly, any ISP can decrypt the ClientHello (defeating the purpose). If you keep it secret, developers can't use ECH.

What CAN work: SVCB/HTTPS records (without ECH)

SVCB/HTTPS DNS records can still be useful without ECH. They tell clients:

• Which port to use (e.g., HTTPS on 8443 instead of 443)
• ALPN protocol negotiation (h2, h3, http/1.1)
• Which IP to connect to

For localhost.direct, adding something like:

localhost.direct. 3600 IN HTTPS 1 . alpn="h2,h3,http/1.1" ipv4hint=127.0.0.1
*.localhost.direct. 3600 IN HTTPS 1 . alpn="h2,h3,http/1.1" ipv4hint=127.0.0.1

...would be valid and useful for protocol negotiation even though all connections are to 127.0.0.1.

Bottom line

• ECH: Not practical with a shared-key model. It would require per-developer keypairs or a private key you can't distribute.
• SVCB/HTTPS records: Yes, these can be added for ALPN/port hints. Worth doing for future-proofing.
• Real ECH testing: If you want to test ECH locally, use a self-generated keypair with your own DNS resolver (dnsmasq/unbound) — that's actually a better test environment anyway.

Hope this helps clarify the landscape! \ud83d\udc4d