Control TLS connections that utilize Encrypted Client Hello

TLS connections that use Encrypted Client Hello (ECH) can be blocked or allowed, and the client can be forced to switch to a non-ECH TLS connection by modifying the DNS over HTTPS (DoH) responses. This increases control and flexibility when managing TLS connections.

If the FortiProxy is performing deep inspection, it always strips the ECH extension from an ECH, effectively forcing the client browser to use a non-ECH TLS connection.

To configure ECH in the CLI:

config firewall ssl-ssh-profile
    edit <name>
        config https
            set status certificate-inspection
            set encrypted-client-hello {block | allow}
        end
        config ech-outer-sni
            edit <name>
                set sni <string>
            next
        end
    next
end

encrypted-client-hello {block | allow}	Block/allow session based on existence of encrypted-client-hello.
ech-outer-sni	ClientHelloOuter Server Name Indications (SNIs) to be blocked.
sni <string>	ClientHelloOuter SNI to be blocked.

To configure stripping ECH information in the CLI:

config dnsfilter profile
    edit <name>
        set strip-ech {enable | disable}
    next
end  

strip-ech {enable | disable}

Enable/disable removal of the ECH service parameter from supporting DNS RRs.

To configure ECH in the GUI:

1. Go to Security Profiles > SSL/SSH Inspection and edit an existing profile or click Create New.

2. Set Inspection method to SSL Certificate Inspection.

3. Set Encrypted Client Hello to Block.

   

4. Click OK.

   SNIs cannot be configured in the GUI.

To configure stripping ECH information in the GUI:

1. Go to Security Profiles > DNS Filter and edit an existing profile or click Create New.

2. Enable Strip Encrypted Client Hello service parameters.

   

3. Click OK.

Blocking TLS connections with certificate inspection when ECH is used in the TLS handshake through the FortiProxy

In this example, an SSL/SSH inspection profile is configured to block TLS connections from some SNIs when ECH is used in the TLS handshake.

To configure blocking a TLS connection that uses ECH:

1. Configure an SSL/SSH inspection profile to block ECH and set the SNIs to match the outer SNI in the ECH message during the TLS handshake:

   config firewall ssl-ssh-profile
       edit "block-ech"
           config https
               set status certificate-inspection
               set encrypted-client-hello block
           end
           config ech-outer-sni
               edit "cloudflare"
                   set sni "cloudflare-ech.com"
               next
               edit "tls-ech"
                   set sni "public.tls-ech.dev"
               next
               edit "defo.ie"
                   set sni "cover.defo.ie"
               next
           end
       next
   end

2. Apply the profile in a firewall policy:

   config firewall policy
       edit 1
           set ssl-ssh-profile "block-ech"
       next
   end

To check the results:

1. In a browser, enable DNS over HTTPS. For example, in Firefox go to Settings > Privacy & Security and under DNS over HTTPS enable Max Protection.

   

2. Visit a website, such as https://public.tls-ech.dev.

   Because ECH is blocked and the outer SNI matches one of the configured SNIs, the ECH initiated by the browser is blocked. In this case, the browser shows a replacement message:

   

3. An SSL log shows the blocked connection:

   1: date=2024-05-07 time=11:39:04 eventtime=1715107144327933775 tz="-0700" logid="1702062101" type="utm" subtype="s
   sl" eventtype="ssl-negotiation" level="warning" vd="root" action="blocked" policyid=1 poluuid="f6848eb2-dc73-51ec-
   165d-e6fe7f98c611" policytype="policy" sessionid=1546437816 service="HTTPS" profile="block-ech" srcip=10.80.1.57 s
   rcport=33204 srccountry="Reserved" dstip=34.138.246.121 dstport=443 dstcountry="United States" srcintf="port1" src
   intfrole="undefined" dstintf="port1" dstintfrole="undefined" proto=6 eventsubtype="encrypted-client-hello" hostnam
   e="public.tls-ech.dev" msg="SSL connection is blocked."

   

4. Try to visit a different website, such as tls-ech.dev, that does not match a default SNI to be blocked. The browser will initial try to establish an ECH-enabled TLS connection to public.tls-ech.dev, but that will be blocked, forcing the browser to connect to the actual website without ECH and, in this case, the browser will load the actual website and not the replacement message:

   

Allowing TLS connections with certificate inspection when ECH is used in the TLS handshake through the FortiGate

In this example, an SSL/SSH inspection profile is configured to allow TLS connections when ECH is used in the TLS handshake.

To configure allowing a TLS connection that uses ECH in the GUI:

1. Go to Security Profiles > SSL/SSH Inspection and edit an existing profile or click Create New.

2. Set Inspection method to SSL Certificate Inspection.

3. Set Encrypted Client Hello to Allow.

4. Click OK.

5. Go to Policy & Objects > Policy and edit an existing policy or click Create New.

6. Set SSL inspection to the SSL/SSH Inspection profile.

   

7. Click OK.

To configure allowing a TLS connection that uses ECH in the CLI:

1. Configure an SSL/SSH inspection profile to block ECH and set the SNIs to match the outer SNI in the ECH message during the TLS handshake:

   config firewall ssl-ssh-profile
       edit "allow-ech"
           config https
               set status certificate-inspection
               set encrypted-client-hello allow
           end
       next
   end

2. Apply the profile in a firewall policy:

   config firewall policy
       edit 1
           set ssl-ssh-profile "allow-ech"
       next
   end

To check the results:

1. In a browser, enable DNS over HTTPS. For example, in Firefox go to Settings > Privacy & Security and under DNS over HTTPS enable Max Protection.

2. Visit a website, such as https://public.tls-ech.dev.

   The ECH-enabled TLS connection is allowed through the firewall policy and the website opens:

   

3. An SSL log shows the allowed connection:

   5: date=2024-05-07 time=11:36:43 eventtime=1715107003423643625 tz="-0700" logid="1702062103" type="utm" subtype="s
   sl" eventtype="ssl-negotiation" level="information" vd="root" action="info" policyid=1 poluuid="f6848eb2-dc73-51ec
   -165d-e6fe7f98c611" policytype="policy" sessionid=1546437808 service="HTTPS" profile="allow-ech" srcip=10.80.1.57
   srcport=34902 srccountry="Reserved" dstip=34.138.246.121 dstport=443 dstcountry="United States" srcintf="port1" sr
   cintfrole="undefined" dstintf="port1" dstintfrole="undefined" proto=6 eventsubtype="encrypted-client-hello" hostna
   me="public.tls-ech.dev"

   

Stripping ECH information from DoH responses

DNS filters are used to strip ECH information from DoH responses, and force the browser to not use ECH for TLS connections. The browser relies on the ECH information from DoH for ECH-enabled TLS connections.

In this example, policy 3 performs deep inspection on DoH traffic between the browser and the DoH server (mozilla.cloudflare-dns.com). A DNS filter profile is applied that strips the ECH information from the DoH response, forcing the browser to use a non-ECH TLS connection. The browser then establishes a TLS connection through policy 1. Although policy 1 has an SSL/SSH inspection profile applied that allows ECH, ECH is not used because the ECH information from the DoH response was stripped by policy 3.

To configure and test stripping ECH information from DoH responses:

1. Configure the DNS filter profile that removes the ECH information:

   config dnsfilter profile
       edit "strip-ech-enable"
           set strip-ech enable
       next
   end

2. Configure a firewall address:

   config firewall address
       edit "mozilla.cloudflare-dns.com"
           set type fqdn
           set fqdn "mozilla.cloudflare-dns.com."  
       next
   end

3. Configure the policies:

   config firewall policy
       edit 3
           set uuid f6848eb2-dc73-51ec-165d-e6fe7f98c611
           set srcintf "any"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "mozilla.cloudflare-dns.com"
           set action accept
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set logtraffic all
           set log-http-transaction all
           set extended-log enable
           set ssl-ssh-profile "deep-inspection"
           set av-profile "default"
           set dnsfilter-profile "strip-ech-enable"
       next
       edit 1
           set uuid 0dae0342-e058-51ec-3eef-00878727409c
           set srcintf "any"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set logtraffic all
           set log-http-transaction all
           set extended-log enable
           set ssl-ssh-profile "allow-ech"
           set av-profile "default"
       next
   end

4. In a browser, go to https://public.tls-ech.dev to see that ECH is not being used:

   

5. The debug log will show that the ECH service parameter was removed:

   # diagnose debug application dnsproxy -1
   ...
   [worker 0] dns_secure_filter_ech()-2166: Found ECH key=5
   ...
   [worker 0] dns_secure_filter_ech()-2203: Removed ECH service parameter

6. If the DNS filter profile is changed to disable stripping the ECH information, then the website will show that ECH is being used:

   config dnsfilter profile
       edit "strip-ech-enable"
           set strip-ech disable
       next
   end