Would it be possible to add ECH support to the Cloudflare workers ?

[HotCakeX]

I was wondering if it'd be possible to add ECH (Encrypted Client Hello) support to the Cloudflare DoH we host on the workers.

[ignoramous]

That's enabled by default. Cloudflare auto-sets the pre-requisite HTTPS / SVCB records. If the client knows what to do, it should be able to ECH with the Workers endpoint just fine.

[HotCakeX]

Thanks, my client which is Edge browser supports ECH and i can verify it using this website

https://defo.ie/ech-check.php

And in Cloudflare test website

https://www.cloudflare.com/ssl/encrypted-sni/

and in Wireshark with this filter ssl.handshake.extension.type == "server_name" and setting SNI as a column

but I see my original domain name in the client hello in DoH connections meaning no ECH is being performed to hide the inner SNI. But since you said Cloudflare workers do support ECH and my client supports it too, I can think of 2 things

1. Either there is a problem with my Cloudflare setup (more likely)
2. Or Edge's built-in DNS client doesn't support ECH even though it supports it for websites ? (unlikely imo)

In Cloudflare I'm using a custom domain of my own which I added as a custom route to Cloudflare worker. I set the minimum TLS version to 1.3 and set the TLS requirement to strict.

[ignoramous]

You're right. For Workers endpoints, ECH doesn't work [0] Not sure what else we could do other than report this to Cloudflare?

[0] notice sni=plaintext for https://dl.nile.workers.dev/cdn-cgi/trace but https://crypto.cloudflare.com/cdn-cgi/trace shows sni=encrypted.

[HotCakeX]

@ignoramous Thanks for checking, yes, if nothing else can be done then reporting to Cloudflare should be enough