Package: dnscrypt-proxy
Version: 2.0.45+ds1-1+b9
Severity: wishlist
Firefox has a feature called encrypted client hello. Unfortunately, it is only activated when a DoH resolver is used by Firefox. Their rationale is that ECH makes no sehse when DOH is not used. It is a bug in Firefox that it has no separate controls about DoH and ECH.
As a workaround DNSCrypt Proxy has a feature providing a local DoH resolver. To activate it a user needs to
* generate a key. I used
openssl genpkey -genparam -algorithm ec -pkeyopt ec_paramgen_curve:P-256 -out ECPARAM.pem
openssl req -x509 -nodes -newkey ec:ECPARAM.pem -subj "/C=XZ/L=own PC/O=localhost/CN=localhost/" -days 5000 -sha256 -keyout localhost.pem -out localhost.pem
* configure DNS-Crypt proxy to run a local resolver using the keys
* open the resolve URI in firefox and add it into security exceptions
* set the URI of a DoH resolver to the local one
In order to provide it we need
* create a new user to run the daemon from
* generate the certs during first installation, put it into /etc/dnscrypt-proxy . Alternatively pregenerated certs can be shipped, they are still used only for a certain port on localhost
* own them by that user
* add the lines into the config