FAQ
pqdoctor
Section titled “pqdoctor”Is it safe to run against servers I don’t own?
Section titled “Is it safe to run against servers I don’t own?”pqdoctor is handshake-only: it reads each server’s first reply and never completes a key-exchange handshake or sends application data. A single check is a handful of short connections and one HEAD / request. That said, scanning other people’s servers is your responsibility. Identify yourself with --contact, keep the default pacing, and honour opt-outs. See Scanning a list.
Why does my server say no-mlkem when I enabled post-quantum?
Section titled “Why does my server say no-mlkem when I enabled post-quantum?”Usually the TLS library underneath is older than you think: nginx or Apache linked against OpenSSL 3.0, say, even if openssl version on the box says 3.5. Check what the server itself is linked against (nginx -V, httpd -V). Or a curve list set by hand leaves X25519MLKEM768 out. See no-mlkem.
pqdoctor and OpenSSL disagree. Which is right?
Section titled “pqdoctor and OpenSSL disagree. Which is right?”Look at where OpenSSL failed. pqdoctor reads the ServerHello, so it answers “which group did the server pick”. OpenSSL completes the whole handshake, so a later problem (a missing SNI certificate, say) fails it even when the key exchange was post-quantum. In the accuracy checks, that’s what explained the disagreements. See Accuracy.
What’s the difference between pq and pq-preferred?
Section titled “What’s the difference between pq and pq-preferred?”Both are post-quantum. pq-preferred servers pick ML-KEM even when the client’s first key share is classical, by asking it to retry. pq servers only use ML-KEM when the client offers it first. Browsers offer both shares, so the difference rarely matters for them.
Why is the origin “unreachable” when the site works?
Section titled “Why is the origin “unreachable” when the site works?”Your browser reaches Cloudflare, not the origin. A well-configured origin behind Cloudflare only accepts Cloudflare’s IPs, so from anywhere else it’s unreachable. Check it from inside its network, or let Flarebox connect to the origin address directly.
Does it check post-quantum certificates?
Section titled “Does it check post-quantum certificates?”Yes, separately from key exchange: the ML-DSA check says whether the server serves an ML-DSA certificate. It’s on by default for one host.
Is there a Linux or macOS build?
Section titled “Is there a Linux or macOS build?”Yes. The Downloads page has a universal macOS binary (Apple silicon and Intel, macOS 11 or later) and static Linux binaries for x86_64 and arm64, next to the Windows one. Or cargo install pqdoctor on any OS with Rust. The Linux x86_64 build passes the full test suite and gave the same answers as the Windows build on 60 real sites; the arm64 build was checked under emulation. The macOS binary is built and inspected but hasn’t been run on a Mac yet.
What does it send exactly?
Section titled “What does it send exactly?”Every byte is documented in Probes and wire format.
Flarebox
Section titled “Flarebox”Is Flarebox made by Cloudflare?
Section titled “Is Flarebox made by Cloudflare?”No. It’s an independent, unofficial project, not affiliated with or endorsed by Cloudflare.
Does Flarebox need my Cloudflare password or Global API Key?
Section titled “Does Flarebox need my Cloudflare password or Global API Key?”No. Workers features use your existing wrangler login. Account views use a scoped API token you create, and Global API Keys are refused. See Tokens and permissions.
Can Flarebox change my zones without me knowing?
Section titled “Can Flarebox change my zones without me knowing?”No. Every change is a stored plan you review as a diff and confirm. It’s refused if the target changed since you looked, and it’s recorded with undo. With no write token, or with read-only mode on, Flarebox can’t change anything at all. See How changes stay safe.
Does Flarebox send data anywhere?
Section titled “Does Flarebox send data anywhere?”Only where it has to: api.cloudflare.com for the Cloudflare views, your own servers for checks you click, and Cloudflare through wrangler for Workers features. No telemetry or analytics. See Privacy.
Does it cost anything?
Section titled “Does it cost anything?”Flarebox and pqdoctor are free and MIT licensed. Some Cloudflare features it shows need a paid plan on Cloudflare’s side (Advanced Certificate Manager for the trust store, for example), and Flarebox says when they do.
Why does Windows warn me about the installer?
Section titled “Why does Windows warn me about the installer?”It isn’t code-signed yet. Check its SHA-256 against the release’s SHA256SUMS.txt.
Is there a Mac or Linux version of Flarebox?
Section titled “Is there a Mac or Linux version of Flarebox?”Not yet. The process-handling code compiles for both but hasn’t been run there.
How do I update?
Section titled “How do I update?”Install the new release over the old one. Settings, history and tokens are kept. There’s no auto-updater yet.