large-hello-dropped

A classical hello works, but any ClientHello padded to post-quantum size and split across packets fails. Something in the path can’t reassemble a ClientHello that spans TCP segments: a load balancer, WAF or firewall that inspects TLS.

The verdict is broken, not just “not post-quantum”. Real browsers send hellos this size today, so these clients may already be failing.

This was 32 of the 3,439 non-post-quantum origins in the study (0.9%).

How pqdoctor sees it

• The classical TLS 1.3 hello (probe 1) works.
• The PQ hello (probe 2) fails.
• The control, a classical hello of the same size split the same way (probe 6), fails too. So it’s the size and the split, not the PQ group. If probe 6 worked, the cause would be pq-group-rejected.

The fix

Update or replace the middlebox. Check every load balancer, WAF and firewall that inspects TLS in front of the server. Update its firmware, or turn off TLS inspection for this traffic.

pqdoctor also prints the stack’s upgrade fix, since the server behind the box may need it too.

Shown in the fix lab

A post-quantum OpenSSL 3.5 server behind a box that drops ClientHellos over 1,200 bytes was reported “Breaks on PQ”. With the box removed, it was post-quantum.

In the study

Server header: nginx 21, unknown 9, apache 2.