demo · v131
server readiness matrix
A reference for which TLS server software supports the hybrid keyshare today, what flag turns it on, and how to test it from the command line. Useful for the operations side of post-quantum migration planning.
support matrix (as of 2026-05)
| server | version | X25519Kyber768 | config note |
|---|---|---|---|
| NGINX (with OpenSSL 3.2+ + oqs-provider) | 1.27+ | yes | ssl_ecdh_curve "X25519MLKEM768"; |
| Caddy | 2.7+ | yes | default once Go 1.23 ships |
| HAProxy (LibreSSL build) | 3.0+ | flag | requires ssl-default-bind-curves |
| Cloudflare | edge | yes | auto-enabled per zone |
| Google Cloud Load Balancer | all | yes | auto |
| AWS ALB | 2024-Q3+ | yes | opt-in via policy |
| node.js (built-in https) | 22.x | flag | --openssl-legacy-provider not allowed |
| node.js | 23.x+ | yes | default |
| Apache (mod_ssl) | 2.4.59+ | flag | SSLOpenSSLConfCmd Groups X25519MLKEM768 |
test it
Two commands for verifying your server actually accepts the hybrid keyshare:
# openssl s_client (OpenSSL 3.2+) openssl s_client -connect example.com:443 -tls1_3 -groups X25519MLKEM768 # look in the response for: # Negotiated TLS1.3 group: X25519MLKEM768
# Wireshark filter to find post-quantum handshakes tls.handshake.extensions.supported_group == 0x11ec # X25519MLKEM768 codepoint
see also
scenario focus
Select a scenario to focus its rendered example and summary.