Fixes by server

pqdoctor reads the Server header (or a mail server’s greeting) to pick the fix. These are the lines it prints, word for word.

What the fix lab proves

The group strings for nginx, Apache, Node, Postfix and Dovecot go through the same OpenSSL call (SSL_CTX_set1_groups_list) that those servers use, on real OpenSSL 3.5 servers. Each one made the server post-quantum (30 / 30). The nginx, Apache, HAProxy, Postfix, Dovecot and Exim binaries themselves weren’t run: they need Linux. Go was run for real (Go 1.25).

Hybrid post-quantum needs TLS 1.3, and a TLS library that has ML-KEM: OpenSSL 3.5+, current BoringSSL and AWS-LC, Go 1.24+, or rustls with aws-lc-rs.

nginx

nginx gets PQ from its TLS library. OpenSSL 3.5 or newer is needed (Ubuntu 25.04+, Debian 13+, or an nginx build linked against 3.5). Check with nginx -V.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;

Apache

Needs mod_ssl built against OpenSSL 3.5 or newer (httpd -V, openssl version).

SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:prime256v1

HAProxy

Use HAProxy built with OpenSSL 3.5+ or AWS-LC (haproxy -vv).

haproxy.cfg

global
    ssl-default-bind-curves X25519MLKEM768:X25519:P-256

Caddy

Go 1.24 offers X25519MLKEM768 by default. Upgrade Caddy and remove any custom curves option, or add x25519mlkem768 to it.

Caddyfile

tls {
    curves x25519mlkem768 x25519 secp256r1
}

Node.js

Check node -p process.versions.openssl. It must be 3.5 or newer.

https.createServer({ ...opts, ecdhCurve: 'X25519MLKEM768:X25519:P-256' }, app)

Go

Go 1.24+ includes X25519MLKEM768 by default. If CurvePreferences is set, remove it.

cfg.CurvePreferences = nil // Go 1.24+ default includes X25519MLKEM768

Any other OpenSSL-based server

Groups = X25519MLKEM768:X25519:prime256v1

IIS / Windows Schannel

PQ key exchange in Schannel depends on the Windows Server version. If yours can’t offer ML-KEM yet, put Cloudflare Tunnel (or a PQ-capable reverse proxy) in front.

Java

Hybrid ML-KEM in JSSE depends on the JDK release. Until yours has it, terminate TLS in a PQ-capable proxy (nginx or HAProxy on OpenSSL 3.5), or use Cloudflare Tunnel.

Mail servers

Postfix, Dovecot, Exim and Exchange are on the Mail (STARTTLS) page.

Can’t upgrade? Cloudflare Tunnel

Run cloudflared next to the server. The tunnel from the server to Cloudflare already uses post-quantum key agreement, so the hop that leaves your network is protected even if the server isn’t.

cloudflared tunnel run <tunnel-name>

When the curve list is hand-set

If pqdoctor sees the server prefers NIST P-curves (pinned-nist), it adds a note to the stack’s fix. A hand-written curve list has to include the PQ group, at the front.