Post-Quantum TLS: Your HTTPS Is Secure Today. But What About Tomorrow?

What Is Post-Quantum TLS? And Why Your Website Needs It Today

Quantum computers aren't here yet. Your encrypted traffic is already being collected for them.

1. How HTTPS protects you

Every HTTPS connection does two things.

1. Key exchange. Browser and server agree on a shared secret key without ever sending it over the wire.

2. Encryption. That key encrypts everything with AES.

Step one relies on math like ECDH (for example X25519) or RSA.

It has held up for over 20 years. Classical computers simply can't solve those problems in time.

2. Where quantum breaks it

In 1994, Peter Shor published Shor's algorithm.

On a large enough quantum computer, it solves the math behind RSA and ECDH fast.

_- Key exchange (RSA, ECDH, X25519): broken.

• AES: only weakened. AES-256 stays safe._

The real weak spot is key exchange.** Get the key, read everything.

3. Why act before quantum computers exist?

Because attackers don't have to wait.

They record encrypted traffic today. When a quantum computer is ready, they decrypt it all, retroactively. This is called harvest now, decrypt later.

Ask one question:

> How many years must your data stay secret?

If how long the data must stay secret + how long your migration takes is longer than the time until quantum arrives, you are already at risk.

This is known as Mosca's theorem. NIST has already published its transition plan away from RSA and ECC (NIST IR 8547).

4. ML-KEM: the quantum-safe replacement

In August 2024, NIST published FIPS 203: ML-KEM.

• Formerly known as CRYSTALS-Kyber.
• Built on lattice math, which has no known fast quantum attack.
• Three levels: ML-KEM-512, 768 and 1024. Higher number, stronger security.

ML-KEM does the same job as ECDH: agree on a shared secret. It just survives quantum attacks.

4. ML-KEM: the quantum-safe replacement

In August 2024, NIST published FIPS 203: ML-KEM.

• Formerly known as CRYSTALS-Kyber.
• Built on lattice math, which has no known fast quantum attack.
• Three levels: ML-KEM-512, 768 and 1024. Higher number, stronger security.

ML-KEM does the same job as ECDH: agree on a shared secret. It just survives quantum attacks.

5. Why hybrid?

ML-KEM is new. If a flaw turns up, you lose everything. So we use both.

X25519MLKEM768 = X25519 (classic) + ML-KEM-768 (new)

• Quantum arrives: ML-KEM still holds.
• ML-KEM has a flaw: X25519 still holds.
• An attacker has to break both.

The cost: about 1 KB more in the handshake. You won't notice it. Chrome, Firefox and Cloudflare already use it by default.

6. What about SSL certificates?

Certificates use digital signatures. Quantum breaks those too. But they are less urgent.

A signature proves identity at the moment you connect. Forging one years later gains an attacker nothing.

Key exchange is different: recorded traffic can be decrypted later.

Priority: key exchange first, certificates next. (The signature standard is ML-DSA, FIPS 204.)

7. Check your website: 3 ways

Option 1: Chrome DevTools

1. Open the site in Chrome and press F12.

2. Go to the Security tab (in newer versions, Privacy and security).
3. Look at the connection line. X25519MLKEM768 means you're covered.

Limits: one site at a time, and you only see what your own browser negotiated.

Option 2: OpenSSL

You need OpenSSL 3.5 or newer.

openssl s_client -connect example.com:443 -groups X25519MLKEM768

openssl s_client -connect example.com:443 -groups X25519MLKEM768

Connects successfully = the server supports it.

Watch out: older OpenSSL doesn't even recognize the name.

This is real output from OpenSSL 3.2. The server supports post-quantum, but the client doesn't, so it falls back to plain X25519.

Lesson: post-quantum needs both sides.

Option 3: QScan (free, nothing to install)

I built QScan to check this in one click.

Enter a domain, hit scan, get four checks and a grade from A+ to F:

• Post-quantum (ML-KEM)
• TLS versions
• SSL certificate
• Security headers

Example: scanning qscan.meklink.com itself.

• ✅ X25519MLKEM768: NEGOTIATED
• ✅ TLS 1.0 and 1.1 disabled
• ⚠️ Content-Security-Policy still missing
• ✅ X25519MLKEM768: NEGOTIATED
• ✅ TLS 1.0 and 1.1 disabled
• ⚠️ Content-Security-Policy still missing

8. How to turn it on

Behind a CDN (e.g. Cloudflare) Check whether post-quantum is enabled. Many providers switch it on automatically.

Caddy or apps written in Go Go 1.24+ enables X25519MLKEM768 by default. Just update.

Nginx / Apache

1. Upgrade OpenSSL to 3.5+, which enables X25519MLKEM768 by default.
2. If you set key exchange groups yourself, add it:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;

Put X25519MLKEM768 first. Older clients still connect with X25519. Nobody gets locked out.

Summary

• The threat: quantum breaks key exchange. Your traffic is being stored today.
• The fix: hybrid X25519MLKEM768. Two locks, not one.
• Status: browsers are ready. Servers are the gap.
• Do it: OpenSSL 3.5+, Go 1.24+, or flip the switch at your CDN.
• Check it: DevTools, OpenSSL, or qscan.meklink.com.

QScan is open source: GitHub

References

Standards

1. NIST, FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM), 2024
2. NIST, FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA, 2024
3. NIST, NIST Releases First 3 Finalized Post-Quantum Encryption Standards, August 2024
4. NIST, IR 8547: Transition to Post-Quantum Cryptography Standards, 2026
5. IETF, Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLSv1.3 (draft-ietf-tls-ecdhe-mlkem)

Research

1. P. W. Shor, Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer, 1994/1995
2. M. Mosca, Cybersecurity in an era with quantum computers: will we be ready?, 2015

Deployment

1. Google Security Blog, A new path for Kyber on the web (Chrome 131 switches to ML-KEM), 2024
2. Mozilla, Firefox enterprise policy: PostQuantumKeyAgreementEnabled (hybrid X25519 + ML-KEM-768 on by default)
3. Cloudflare, The state of the post-quantum Internet, 2024
4. Go, Go 1.24 release notes (X25519MLKEM768 enabled by default)
5. OpenSSL, OpenSSL 3.5 release notes (default keyshares X25519MLKEM768 and X25519)

Only scan sites you own or are authorized to test.