3. ECHConfig File

A PEM ECH file contains zero or one private key and one encoded ECHConfigList. The public and private keys MUST both be PEM encoded [RFC7468].

The file contains the concatenation of the PEM encoding of the private key, if present, followed by the PEM encoding of the public keys as an ECHConfigList. When a private key is present, the ECHConfigList MUST contain an ECHConfig that matches the private key. The private key MUST be encoded as a PKCS #8 PrivateKey [RFC7468].

The public keys MUST be the base64-encoded form of an ECHConfigList value that can be published in the DNS using an HTTPS resource record as described in [RFC9848]. The string "ECHCONFIG" MUST be used in the PEM file delimiter for the public key. Any content after the PEM-encoded ECHConfigList SHOULD be ignored.

Figure 1 shows an example ECHConfig PEM file.

Figure 1: Example ECHConfig PEM File

If that ECHConfigList were published in the DNS for foo.example.com, it could be accessed as shown in Figure 2.

$ dig +short HTTPS foo.example.com
1 . ech=AD7+DQA65wAgACA8wVN2BtscOl3vQheUzHeIkVmKIiydUhDCliA4iyQR
wAEAAEAAQALZXhhbXBsZS5jb20AAA==

Figure 2: Use of Dig to Get the ECHConfigList from DNS

TLS servers using this file format might configure multiple file names as part of their overall configuration, for example when only the ECHConfigList values from a subset of those files are to be used as retry_configs in the ECH fallback scenario.

An ECHConfigList in a PEM file might contain more than one ECHConfig, such as when those values contain different extensions or different public_name values. Consistent with [RFC9849], ECHConfig values appear in decreasing order of preference. If the ECHConfigList is used as retry_configs, it might contain different public keys. Nonetheless, when a private key is present, that key MUST match the public key from one of the ECHConfig values.

3. ECHConfig File​

3. ECHConfig File