SECURITY Signal 436
Encrypted Client Hello (ECH) is now supported on Vercel CDN
↗
Vercel CDN has added support for Encrypted Client Hello (ECH), concealing the Server Name Indication (SNI) in TLS handshakes for domains using Vercel DNS.
ECH closes the last unencrypted metadata leak in HTTPS connections, preventing network observers from identifying the specific hostname a client accesses. This reduces passive surveillance risks for applications hosted on Vercel’s CDN. Adoption is automatic where client and server support align, lowering operational overhead.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
ECH encrypts the Server Name Indication (SNI) in TLS handshakes, hiding the target hostname from network observers.
Support is enabled automatically for domains using Vercel DNS and compatible browsers like Chrome, Edge, and Firefox.
Traffic appears to route to Vercel’s shared ECH hostname (vercel-ech.com), masking the actual destination domain.
THE CLUSTER