Skip to content
pqdoctor

Fixing a config

Terminal window
pqdoctor fix --config /etc/nginx/nginx.conf
--- /etc/nginx/nginx.conf
+++ /etc/nginx/nginx.conf (pqdoctor)
@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
     ssl_certificate /etc/ssl/c.pem;
-    ssl_ecdh_curve X25519:prime256v1;
+    ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;
 }

By default nothing changes. pqdoctor prints a unified diff and its notes. With --write it copies the file to PATH.bak (or .bak.1, … if that exists), writes the new one, and prints the commands to test, reload and re-check. It never reloads or restarts anything.

Terminal window
sudo pqdoctor fix --config /etc/nginx/nginx.conf --write --host www.example.org
# Then test, reload and re-check:
#   sudo nginx -t
#   sudo systemctl reload nginx
#   pqdoctor www.example.org

What it changes

Section titled “What it changes”
--stack Setting
nginx ssl_ecdh_curve: X25519MLKEM768 put first, or added to http {} (or each server {}) if missing. TLSv1.3 added to ssl_protocols if missing
apache SSLOpenSSLConfCmd Groups / Curves: put first, or added after SSLEngine on in each virtual host. +TLSv1.3 added to SSLProtocol -all …
haproxy ssl-default-bind-curves in global (added if missing), and curves on bind lines
postfix tls_eecdh_auto_curves in main.cf
dovecot ssl_curve_list (Dovecot 2.3’s name)
sshd The first KexAlgorithms before any Match: mlkem768x25519-sha256, sntrup761x25519-sha512 and sntrup761x25519-sha512@openssh.com put first. A +… list (which appends to OpenSSH’s default, post-quantum since 9.0) and a missing line are left alone
caddy, iis Nothing to rewrite. It explains what to do instead: upgrade Caddy and drop custom curves; for Schannel it depends on the Windows version

pqdoctor picks the stack from the file’s name and contents; --stack overrides it. Comments, indentation, the other values in a list and CRLF line endings are kept. Run it again on a fixed file and it says “Nothing to change in this file.”

Tested on sample configs for every stack (unit tests and the CLI), not yet against live servers’ configs.