no-tls, no-reply, connect-failed

These three causes mean pqdoctor couldn’t get far enough to say anything about post-quantum. It reports that plainly rather than guessing.

no-tls

TLS alerts to every hello, including the classical and P-curve ones. Verdict noTls13: “No TLS handshake at all”. Common reasons are that the port isn’t TLS, or the server needs a different SNI name.

In the study: 41 of 3,439 non-post-quantum origins (1.2%).

no-reply

Only timeouts or resets, with no TLS alert at all. Verdict unreachable: “No reliable reply”. The server may be down, behind a firewall, or rate-limiting repeated connections. Re-check in a minute.

This verdict exists because of a mistake. An early version fired its probes in parallel, and www.debian.org rate-limited the burst, so pqdoctor said “No TLS handshake at all”. That was confidently wrong. Now the probes run one at a time, a silent probe is retried once, and silence is reported as silence.

connect-failed

The TCP connection couldn’t be opened. Verdict unreachable: “Couldn’t reach host:port”. In a multi-address report, an address that’s unreachable from this machine (for example, IPv6 with no IPv6 route) is marked as such, not as a disagreement.

In the study

523 of the 5,139 probed origins gave no TLS answer on port 443. They’re left out of every share, which is why the denominator is 4,616.