# Encrypted Client Hello (ECH) with Gateway API

**URL:** <https://discuss.kubernetes.io/t/encrypted-client-hello-ech-with-gateway-api/33527>\
**Category:** General Discussions\
**Tags:** security, network\
**Created:** [November 3, 2025, 3:00pm UTC](https://discuss.kubernetes.io/t/encrypted-client-hello-ech-with-gateway-api/33527 "2025-11-03T15:00:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fuero](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/fuero/32/17767_2.png) [@fuero](https://discuss.kubernetes.io/u/fuero)\
**Post date:** [November 3, 2025, 3:00pm UTC](https://discuss.kubernetes.io/t/encrypted-client-hello-ech-with-gateway-api/33527/1 "2025-11-03T15:00:13Z")

</div>

Hi,

the gateway API docs (and ingress API docs) don’t mention how or if [encrypted client hello (ECH)]( [draft-ietf-tls-esni-25 - TLS Encrypted Client Hello](https://datatracker.ietf.org/doc/draft-ietf-tls-esni/) ) support is handled.

The k8s docs only refer to SNI in the [ingress section](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls), I can’t find ECH mentioned.

Is there work on the way to support this?