We have added support for ECH to curl. It can use HTTPS RRs published in the
DNS if curl uses DoH, or else can accept the relevant ECHConfigList values
-from the command line. This works with OpenSSL, wolfSSL, BoringSSL or AWS-LC as
-the TLS provider.
+from the command line. This works with OpenSSL, wolfSSL, BoringSSL, AWS-LC
+or rustls-ffi as the TLS provider.
This feature is EXPERIMENTAL. DO NOT USE IN PRODUCTION.
TLS-backend:
- OpenSSL
- wolfSSL
+ - rustls
Added-in: 8.8.0
---
This experimental feature requires a special build of OpenSSL, as ECH is not
yet supported in OpenSSL releases. In contrast ECH is supported by the latest
-BoringSSL and wolfSSL releases.
+BoringSSL, wolfSSL and rustls-ffi releases.
There is also a known issue with using wolfSSL which does not support ECH when
the HelloRetryRequest mechanism is used.