Zscaler outlines enterprise controls for Encrypted Client Hello

Zscaler has published guidance on how enterprises should adapt their security architecture to Encrypted Client Hello, the IETF-standardised extension now specified in RFC 9849. Google’s support for ECH in Android 17 marks a shift from a browser-only feature to a mainstream platform capability, following earlier adoption in Chrome 117, Firefox 119 and Chromium-based browsers such as Edge.

ECH encrypts the real Server Name Indication in the TLS ClientHello, so the visible SNI can no longer be treated as proof of the service a client is contacting. Zscaler warns that broad SNI-based TLS inspection bypasses, particularly for certificate-pinned applications, can become evasion paths, and recommends controlling ECH discovery through DNS, using ECH’s authenticated fallback with a trusted inspection proxy, binding SNI to destinations via Optimize DNS Resolution, and applying Endpoint Context to narrow exceptions.