Skip to main content

This nice blog post about PQC and HaProxy details the steps required once you've ascertained that your openssl supports the necessary curves. Here's a script that tests for those PQC curves required to implement. 

for KTEST in X25519MLKEM768 X25519 P-256 P-384 ; do 
   echo -n "testing $KTEST:"; 
   echo -e "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n" | 
           openssl s_client -groups "$KTEST" -connect localhost:443 2>&1 |
           grep -E "unknown|Key|error|$KTEST";
   echo "" ;
done 

You should see something like this: 

testing X25519MLKEM768:Negotiated TLS1.3 group: X25519MLKEM768
testing X25519:Peer Temp Key: X25519, 253 bits
testing P-256:Peer Temp Key: ECDH, prime256v1, 256 bits
testing P-384:Peer Temp Key: ECDH, secp384r1, 384 bits
 

 

which indicates

GroupSupported?Negotiated?Notes
X25519MLKEM768✔ Yes✔ YesPQ-hybrid TLS group: requires OpenSSL 3.2+
X25519✔ Yes✔ YesFastest + default modern curve: quantum‑vulnerable
P‑256✔ Yes✔ YesMost compatible NIST curve
P‑384✔ Yes✔ YesStronger NIST curve