DisableEncryptedClientHello

Disable the TLS Feature for Encrypted Client Hello. Note that TLS Client Hellos will still contain an ECH extension, but this extension will not be used by Firefox during the TLS handshake.

Values

Set to true to disable Encrypted Client Hello (ECH) for both DNS and HTTP/3.
Set to false to leave ECH enabled. This is the same as not setting the policy.

Examples

{
  "policies": {
    "DisableEncryptedClientHello": true
  }
}

JSON schema

{
  "type": "boolean"
}

Windows (GPO)

Software\Policies\Mozilla\Firefox\DisableEncryptedClientHello = 0x1 | 0x0

macOS

<dict>
  <key>DisableEncryptedClientHello</key>
  <true/> | <false/>
</dict>

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 127	Available since 128	Available since 149

CCK2 Equivalent: N/A
OMA-URI: DisableEncryptedClientHello
Preferences Affected: network.dns.echconfig.enabled, network.dns.http3_echconfig.enabled