Post-quantum TLS on Apache, Caddy, HAProxy and Cloudflare
Updated:
Every server below negotiates the same hybrid group, X25519MLKEM768 (X25519 combined with ML-KEM-768 from FIPS 203). What differs is which crypto library it uses and whether the group is on by default. For nginx see the nginx guide.
Apache httpd
Needs mod_ssl linked against OpenSSL 3.5+ (check with openssl version and apachectl -V). The group is on by default there; set it explicitly if your config already has a Groups or SSLOpenSSLConfCmd Curves line:
SSLProtocol -all +TLSv1.2 +TLSv1.3 SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:prime256v1
Caddy
Caddy uses Go's crypto/tls, which enables X25519MLKEM768 by default from Go 1.24. Caddy 2.10 and newer are built with it, so upgrading is usually all you need. Remove any curves option in the tls block, or include the hybrid group in it.
caddy version # 2.10 or newer
example.com {
reverse_proxy 127.0.0.1:8000
}
Any other Go server (Traefik, custom services) gets the same default once it is built with Go 1.24+.
HAProxy
Needs HAProxy built against OpenSSL 3.5+ or AWS-LC. Set the groups on the bind line:
bind :443 ssl crt /etc/haproxy/certs/ curves X25519MLKEM768:X25519:P-256
Cloudflare and other CDNs
Cloudflare negotiates X25519MLKEM768 with browsers on all plans by default. Proxy the domain through it (the orange cloud) and the connection between the visitor and Cloudflare is post-quantum even if your origin is not. The hop from Cloudflare to your origin is a separate connection: upgrade the origin as well if that link crosses the public internet.
This is the fastest fix for an old server you cannot upgrade.
Verify
Run the free scan. Grade A means TLS 1.3 with a hybrid post-quantum key exchange. Grade B means TLS 1.3 with classical key exchange only.