pq-group-rejected
Same-size classical hellos are fine, but offering X25519MLKEM768 breaks the handshake. Something doesn’t tolerate a key-share group it doesn’t know. A correct stack ignores an unknown group and picks one it knows.
The verdict is broken. In the study, 2 of 3,439 non-post-quantum origins.
How pqdoctor sees it
Section titled “How pqdoctor sees it”- The classical TLS 1.3 hello (probe 1) works.
- The PQ hello (probe 2) fails.
- The same-size classical hello split the same way (probe 6) works, so size isn’t the problem. The codepoint is.
The fix
Section titled “The fix”Find what chokes on the X25519MLKEM768 codepoint (0x11EC). It’s usually an old TLS-inspecting appliance, or a TLS library with a key-share parsing bug. Update it.
Shown in the fix lab
Section titled “Shown in the fix lab”A post-quantum OpenSSL 3.5 server behind a box that resets on the X25519MLKEM768 codepoint was reported “Breaks on PQ”. With the box removed, it was post-quantum.