kyber-draft-only
The server supports the pre-standard Kyber draft group, but not final ML-KEM. It only knows X25519Kyber768Draft00 (0x6399), which browsers have dropped.
In the study, 1 of 3,439 non-post-quantum origins.
How pqdoctor sees it
Section titled “How pqdoctor sees it”The Kyber draft hello (probe 4) gets X25519Kyber768Draft00. The ML-KEM hello (probe 2) doesn’t get a post-quantum group.
The fix
Section titled “The fix”Move from the Kyber draft to final ML-KEM. Upgrade the TLS library to one with X25519MLKEM768 (0x11EC). pqdoctor also prints the upgrade fix for the stack it finds.
Not shown in the fix lab
Section titled “Not shown in the fix lab”No maintained TLS stack still ships X25519Kyber768Draft00 alone, so there’s no real server to test against. This cause is covered by unit tests only.