1891470 - Enterprise Policy Support for Encrypted Client Hello

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Dennis Jackson]

When ECH was introduced, support depended on DoH being enabled. We should add an individual toggle now that we can support fetching ECH configs from a wider variety of sources.

Comment 1

[Dennis Jackson]

Attachment: Bug 1891470 - Add an Enterprise Policy for Encrypted Client Hello.

Comment 2

[Dennis Jackson]

Release Note Request
[Why is this notable]:

• This adds a new Enterprise policy to control whether Encrypted Client Hello is used by Firefox.

[Affects Firefox for Android]:

• I don't think Enterprise Policies are supported on Android.

[Suggested wording]:

• In the Enterprise Release Notes: "Added a [DisableEncryptedClientHello](https://mozilla.github.io/policy-templates/
  #DisableEncryptedClientHello) policy which disables the use of Encrypted Client Hello in Firefox. "

[Links (documentation, blog post, etc)]:

• https://mozilla.github.io/policy-templates/#DisableEncryptedClientHello - Not live yet, awaiting this PR to be merged.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a1e59a1f75fa
Add an Enterprise Policy for Encrypted Client Hello. r=jschanck,mkaply,fluent-reviewers,bolsson

Comment 4

[Aron Cseh]

https://hg.mozilla.org/mozilla-central/rev/a1e59a1f75fa

Comment 5

[Mike Kaply [:mkaply]]

This doesn't apply to the ESR, correct?

Comment 6

[Pascal Chevrel:pascalc]

Dennis, is it a request to add it to both our detailed enterprise notes on SUMO (like https://support.mozilla.org/en-US/kb/firefox-enterprise-125-release-notes) and to the enterprise section of our consumer release notes page for this release (like https://www.mozilla.org/en-US/firefox/125.0.1/releasenotes/) or only for the SUMO one? Thanks!

Comment 7

[Dennis Jackson]

(In reply to Mike Kaply [:mkaply] from comment #5)

This doesn't apply to the ESR, correct?

That's correct!

(In reply to Pascal Chevrel:pascalc from comment #6)

Dennis, is it a request to add it to both our detailed enterprise notes on SUMO (like https://support.mozilla.org/en-US/kb/firefox-enterprise-125-release-notes) and to the enterprise section of our consumer release notes page for this release (like https://www.mozilla.org/en-US/firefox/125.0.1/releasenotes/) or only for the SUMO one? Thanks!

Just the SUMO is fine I think, thanks!