This nice blog post about PQC and HaProxy details the steps required once you've ascertained that your openssl supports the necessary curves. Here's a script that tests for those PQC curves required to implement.
for KTEST in X25519MLKEM768 X25519 P-256 P-384 ; do
echo -n "testing $KTEST:";
echo -e "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n" |
openssl s_client -groups "$KTEST" -connect localhost:443 2>&1 |
grep -E "unknown|Key|error|$KTEST";
echo "" ;
done You should see something like this:
testing X25519MLKEM768:Negotiated TLS1.3 group: X25519MLKEM768
testing X25519:Peer Temp Key: X25519, 253 bits
testing P-256:Peer Temp Key: ECDH, prime256v1, 256 bits
testing P-384:Peer Temp Key: ECDH, secp384r1, 384 bits
which indicates
| Group | Supported? | Negotiated? | Notes |
|---|---|---|---|
| X25519MLKEM768 | ✔ Yes | ✔ Yes | PQ-hybrid TLS group: requires OpenSSL 3.2+ |
| X25519 | ✔ Yes | ✔ Yes | Fastest + default modern curve: quantum‑vulnerable |
| P‑256 | ✔ Yes | ✔ Yes | Most compatible NIST curve |
| P‑384 | ✔ Yes | ✔ Yes | Stronger NIST curve |
- Log in to post comments