tls12-only

The server answers with TLS 1.2. Hybrid post-quantum key exchange only exists in TLS 1.3, so nothing else matters until TLS 1.3 is on.

This was 33.3% of the non-post-quantum origins in the study: 1,146 of 3,439.

How pqdoctor sees it

Every probe, even the classical TLS 1.3 one, gets a TLS 1.2 ServerHello. Real output for nginx.org on 2026-10-15:

pqdoctor nginx.org (probes)

Probes
  · TLS 1.3 with classical groups                  TLS 1.2 ServerHello (78 ms)
  · Offer only an X25519MLKEM768 key share         TLS 1.2 ServerHello (76 ms)
  · X25519 share, ML-KEM listed first              TLS 1.2 ServerHello (77 ms)
  · Old draft group X25519Kyber768Draft00          TLS 1.2 ServerHello (80 ms)
  · PQ ClientHello split across two TCP segments   TLS 1.2 ServerHello (117 ms)
  · Classical ClientHello, same size, split        TLS 1.2 ServerHello (121 ms)
  · P-256 / P-384 only                             TLS 1.2 ServerHello (82 ms)

The fix

Turn on TLS 1.3, then add the PQ group:

# nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;

# Apache
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:prime256v1

The TLS library underneath has to be OpenSSL 3.5 or newer for the group to exist. Every server is on Fixes by server.

Shown in the fix lab

An OpenSSL 3.5 server capped at TLS 1.2 was reported tls12-only. After enabling TLS 1.3 (ssl_protocols TLSv1.2 TLSv1.3) and the groups line, it was post-quantum.

Separately, OpenSSL requiring TLS 1.3 got a protocol_version alert from all three tls12-only sites in the 60-site comparison: nginx.org, www.mit.edu and www.baidu.com.

Many are redirectors

Many tls12-only hosts are bare domains (the Tranco entry), not the site people visit. Among the first 300 origins, the study probed the www. names of 51 TLS 1.2 apexes. For 22 of them, www. was on a CDN (Akamai 13, CloudFront 6, Cloudflare 3): the apex is a leftover redirect server in front of a CDN-hosted site.

That host still terminates TLS for everyone who types the bare domain, so it’s a real gap, and a cheap one to fix. It also means the headline percentage partly measures redirectors.

In the study

Server header for tls12-only origins: unknown 491, nginx 315, aws 177, apache 134, iis 23.