pinned-nist

TLS 1.3 works, but the server only negotiates NIST P-curves and prefers them over X25519. That’s almost always a hand-set curve list that leaves out X25519MLKEM768, or a TLS library too old to have it.

This was 3.2% of the non-post-quantum origins in the study: 109 of 3,439.

How pqdoctor sees it

• A client offering an X25519 key share is asked to retry with P-256 or P-384, or
• only the P-256 / P-384 hello (probe 7) completes.

The fix

Put X25519MLKEM768 at the front of the hand-set list:

# Apache (mod_ssl on OpenSSL 3.5+)
SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:prime256v1

# nginx
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;

The TLS library still has to have ML-KEM (OpenSSL 3.5+). Every server is on Fixes by server.

Shown in the fix lab

An OpenSSL 3.5 server with groups pinned to P-256:P-384 was reported not post-quantum. After the Apache snippet’s Groups X25519MLKEM768:X25519:prime256v1, it was post-quantum. A POP3 STARTTLS server pinned the same way was fixed by the Dovecot list.

In the study

Server header for pinned-nist origins: unknown 83, nginx 9, iis 7, aws 5, apache 4.