ech_required
ech_required (121) is sent when the server requires Encrypted Client Hello (ECH) but the client did not use it. ECH encrypts the SNI and other sensitive ClientHello fields to prevent network observers from seeing which hostname is being connected to. This alert was added in the ECH specification.
Alert Code
121
Level
Fatal
Standard
RFC 8446
Description
Encrypted Client Hello (ECH, draft-ietf-tls-esni) addresses the privacy gap in TLS where the SNI hostname in ClientHello is visible to network observers even though the subsequent communication is encrypted. When a server requires ECH (typically signaled via DNS HTTPS records) and a client connects without it, the server sends ech_required. The server includes a retry_configs payload in the alert so the client can obtain the correct ECH public key and retry. This is a relatively new alert added alongside ECH standardization.
Common Causes
- –Server requires ECH but client sent a plaintext SNI ClientHello
- –Client's cached ECH config is outdated – server rotated its ECH key
- –Client TLS implementation does not support ECH
- –ECH retry_configs provided but client failed to use them