Sidecars
An upgrade to OpenSSL 3.5 can mean a new OS release. A sidecar makes the server post-quantum today without touching its TLS library.
pqdoctor sidecar www.example.orgcloudflared, when it fits
Section titled “cloudflared, when it fits”All four have to hold — an unknown one is reported, never assumed:
| Check | |
|---|---|
| A Cloudflare zone you manage | --cloudflare-zone (Flarebox knows from your token) |
| An HTTP(S) service | a tunnel carries HTTP, not SMTP |
| Outbound TCP 7844 to the tunnel edge | --local, run on the server |
| No other CDN in front | from the Server header |
pqdoctor writes /etc/cloudflared/config.yml (ingress for the host with originServerName) and the steps, ending in cloudflared tunnel run --post-quantum, which refuses a classical tunnel connection. If the name is already a proxied record in your zone, browsers already get post-quantum from Cloudflare’s edge; the tunnel replaces the edge’s connection to your server (tunnel route dns --overwrite-dns).
Caddy 2.10+, otherwise
Section titled “Caddy 2.10+, otherwise”Caddy 2.10 was the first release built on Go 1.24, which offers X25519MLKEM768 by default. pqdoctor writes a Caddyfile that terminates TLS on :443 and forwards to the existing server, moved to a local port (--upstream, default 127.0.0.1:8443); --cert / --key give it your certificate, or Caddy gets one itself.
pqdoctor sidecar www.example.org --kind caddy --upstream 127.0.0.1:8443 --write-files ./pq--write-files DIR writes the files instead of printing them, and never over an existing file. Each plan ends with its undo.
Then upgrade
Section titled “Then upgrade”The fingerprint prints the upgrade path for the library it found — e.g. Ubuntu 26.04 LTS (OpenSSL 3.5.5), Debian 13, RHEL-family 9.7+/10.1+, current Amazon Linux 2023, Go 1.24+, JDK 27, or Windows Server 2025’s ML-KEM hybrids (off by default; the ECC Curve Order policy). These are instructions only — pqdoctor never runs an upgrade.