SERVER REMEDIATION RUNBOOK · IANA 0x11ECOPENSSL 3.5+ · NGINX · HAPROXY · OPENSSH 9.9+

Hybrid X25519MLKEM768 Remediation & Server Configuration Guides

Enabling post-quantum confidentiality on public HTTPS and SSH endpoints no longer requires custom C patches. Use these verified configurations on OpenSSL 3.5+, Nginx, HAProxy, and OpenSSH 9.9+, then confirm negotiation with the Q-Day Check TLS Scanner.

Illuminated network server racks terminating hybrid TLS 1.3 key exchange connections

/etc/nginx/conf.d/tls-pqc.conf

OpenSSL 3.5+ Native

1. Nginx + OpenSSL 3.5+ (Hybrid X25519MLKEM768 Ingress)

OpenSSL 3.5 includes native ML-KEM support without third-party out-of-tree providers. Order X25519MLKEM768 first so legacy clients fall back cleanly to X25519.

# /etc/nginx/conf.d/tls-pqc.conf
ssl_protocols TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:X25519:secp256r1;
ssl_prefer_server_ciphers off;

# Verify negotiated group from a client with OpenSSL 3.5+:
# openssl s_client -connect yourdomain.com:443 -groups X25519MLKEM768:X25519

/etc/ssh/sshd_config.d/10-pqc-kex.conf

OpenSSH 9.9+

2. OpenSSH 9.9+ Bastion Hardening (mlkem768x25519-sha256)

Administrative SSH sessions carry database tunnels and credentials susceptible to Harvest-Now-Decrypt-Later recording. OpenSSH 9.9+ adds NIST FIPS 203 hybrid key exchange.

# /etc/ssh/sshd_config.d/10-pqc-kex.conf
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,curve25519-sha256

# Validate configuration before reload:
# sshd -t && systemctl reload sshd

/etc/haproxy/haproxy.cfg

HAProxy 3.1+

3. HAProxy 3.1+ (Compiled Against OpenSSL 3.5+)

Configure curves on the bind line or global ssl-default-bind-curves directive.

global
    ssl-default-bind-options ssl-min-ver TLSv1.3 no-tls-tickets
    ssl-default-bind-curves X25519MLKEM768:X25519:P-256

CLI Diagnostic Probe

MTU / DPI Verification

4. Diagnosing Two-Packet ClientHello MTU Middlebox Drops

X25519MLKEM768 expands the ClientHello key_share from 32 bytes to 1,216 bytes, pushing total ClientHello size across two 1,500-byte TCP segments. Test whether older stateful DPI appliances stall:

# Compare classical handshake time vs hybrid ML-KEM handshake time:
curl -w "Classical connect: %{time_appconnect}s\n" -o /dev/null -s --curves X25519 https://yourdomain.com
curl -w "Hybrid PQC connect: %{time_appconnect}s\n" -o /dev/null -s --curves X25519MLKEM768:X25519 https://yourdomain.com

Reviewed by Callum Reid, Principal Infrastructure & Cryptography Editor

Tests OpenSSL 3.5 and OpenSSH 9.9 hybrid transport configurations.

Last reviewed: 2026-11-01

Reviewed every 3 months

AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.

Verified Primary Sources

Hybrid Key Exchange in TLS 1.3 (X25519MLKEM768, 0x11EC) (IETF TLS Working Group, IETF Draft Specification)
OpenSSH 9.9 Release Notes (mlkem768x25519-sha256) (OpenSSH Project, September 2024)
OpenSSL 3.5 Release Notes (Native FIPS 203/204/205 Support) (OpenSSL Corporation / Project, 2025 Release Series)

Get Server Config Updates When TLS Libraries Ship Changes

PQC & Hybrid TLS Readiness Briefings

Store your email for tested hybrid PQC configuration notes when TLS and SSH libraries ship revisions. No emails are sent yet.