pq-other-group

0.2.0

This cause code is new in pqdoctor 0.2.0. It comes from the group survey, which is on by default for one host and --groups for scans. Without the survey, such a server is reported as no-mlkem.

The server does post-quantum key exchange, just not with X25519MLKEM768. Offered only SecP256r1MLKEM768, SecP384r1MLKEM1024 or a pure ML-KEM group, it picks it. But browsers, Go, OpenSSL and rustls send X25519MLKEM768, so in practice they negotiate a classical group.

The verdict is pqWithWarning (exit status 0), with group set to the group it accepts and a warning to add X25519MLKEM768.

How pqdoctor sees it

• The “PQ only” probe (an X25519MLKEM768 share, with X25519 and P-256 also listed) gets a retry to a classical group.
• In the survey, a hello offering only SecP256r1MLKEM768 (say) gets a ServerHello that picks it.

This is what a server looks like whose groups were set for CNSA 2.0 or FIPS (NIST curves only), or whose TLS stack shipped the NIST-curve hybrids first.

The fix

Put X25519MLKEM768 first and keep the group you have:

ssl_ecdh_curve X25519MLKEM768:SecP256r1MLKEM768:X25519:prime256v1;

SSLOpenSSLConfCmd Groups X25519MLKEM768:SecP256r1MLKEM768:X25519:prime256v1

pqdoctor fix --config PATH does this for you for nginx, Apache, HAProxy, Postfix and Dovecot.