Problem
Until about a week ago, my clients site on a sub domain (app.xxx.com) worked fine and we haven't pushed anything major between now and then, but now on Chrome (117.0.5938.132) on Windows it started returning this error:
This site can't be reached
The website at XXX might be temporarily down or it may have been moved permanently to a new web address.
ERR_ECH_FALLBACK_CERTIFICATE_INVALID
TLD seems to be working fine. Cert is issued by LetsEncrypt.
Testing
I then tested this on the latest Chrome on MacOs an Linux and they both worked fine. I also tested this on other browsers like Firefox and Safari and they also worked fine. I also issued a new LetsEncrypt cert, but this made no difference.
Codebase, server environment and other oddities
Sometimes the site will resolve for a minute or two and then stops working? We have a staging version of the app on another subdomain (staging.xxx.com) that does work. We use docker containers on the same server so they should be the same environment. The code differences between the two are fairly minimal, and shouldn't effect this I would have thought?
Help
I've pushed this out to our web hosting company to try and resolve, but figured I should also post it out to see if others have any experience with this or a way to resolve it as there isn't much useful (to me at least) information out there that I have found yet. For now I'm telling our customers to use another browser, but this isn't a long term solution anyone is happy with.
Does anyone know anything more about this or how to resolve it?
EDIT - Found the issue
Ok, so I can now confirm it's to do with Encrypted Client Hello (ECH), also referred to as Secure SNI: https://www.ghacks.net/2022/11/25/google-chrome-canary-gets-experimental-encrypted-client-hello-ech-support/
If I turn this flag (chrome://flags/#encrypted-client-hello - and restart your browser afterwards) on in Chrome Linux, it now throws that error.
Turning it explicitly off in Windows and the site works - so this is the issue.
More information about ECH being enforced in Cloudflare and how it works: https://blog.cloudflare.com/announcing-encrypted-client-hello/
How to fix this is probably on whoever is dealing with your sites ECH (eg: Cloudflare) - but please do post if anyone has any other useful information.
I found a bit better of a solution for my case I think (and others on CF free plans).
If you are not on a free plan - you can disable ECH as noted in the question.
Otherwise, you can try disabling TLS 1.3 in Cloudflare settings.
For me the issue was as follows:
Long-term, I may need to figure out a better solution (maybe get my server supporting ECH?), but for now:
Disabling TLS 1.3 seems to be a viable solution - at least for me.