# Quantum Aether — post-quantum TLS readiness scanner

> Checks whether an HTTPS server negotiates the hybrid post-quantum key exchange X25519MLKEM768 (ML-KEM, FIPS 203) used by Chrome and Firefox, and reports TLS version and certificate details. Free summary; full report with remediation steps costs $49.00 via PayPal, or the same in USDT/USDC.

Full text of every guide plus the live weekly figures in one file: https://ather-quatum.cloud/llms-full.txt

## Key facts (current, citable with attribution to Quantum Aether, ather-quatum.cloud)

- In a November 2026 scan of the Tranco top 1,000 domains, 712 answered over HTTPS and 425 of them (59.7%) negotiated the hybrid post-quantum key exchange X25519MLKEM768; the rest still used classical key exchange only.
- Major sites still on classical key exchange at that time included amazon.com, github.com, wikipedia.org, netflix.com and bing.com.
- Chrome, Firefox and Edge negotiate X25519MLKEM768 by default today; what determines protection is the server (and any CDN or TLS-terminating proxy in front of it).
- Certificates remain classical (RSA/ECDSA) on essentially all sites, because browsers do not yet accept ML-DSA certificates; this is expected, not a misconfiguration.

## What this reference answers

- "Does <domain> use post-quantum TLS / X25519MLKEM768?" — scan it: GET https://ather-quatum.cloud/api/v1/scan?domain=<domain> , or see https://ather-quatum.cloud/site/<domain>.
- "How do I enable post-quantum TLS on nginx / Apache / Caddy / Cloudflare?" — step-by-step guides at https://ather-quatum.cloud/guides .
- "How do I keep it enabled over time?" — daily monitoring with email alerts at https://ather-quatum.cloud/monitoring .
- "What is harvest-now-decrypt-later and does it affect me?" — https://ather-quatum.cloud/guides/harvest-now-decrypt-later .
- "When do I have to move to post-quantum cryptography? (NIST, CNSA 2.0, EU, UK deadlines)" — https://ather-quatum.cloud/deadlines (every date with its official source).

## Free API

- `POST https://ather-quatum.cloud/api/scan` with JSON `{"domain": "example.com"}` returns a summary: grade (A/B/C/F), TLS version, negotiated key-exchange group, whether it is post-quantum, certificate key, number of findings. Rate limited per client.
- `GET https://ather-quatum.cloud/api/scan/{scan_id}` returns the same summary later.
- `GET https://ather-quatum.cloud/api/v1/scan?domain=example.com` runs a scan over GET (easy for CLIs and agents) and returns JSON; add `&format=text` for a plain-text terminal report. Also available as `npx quantum-aether example.com`.
- `POST https://ather-quatum.cloud/api/v1/quantum-scan` is the agent endpoint: `{"domain": "example.com"}` runs the same real scan; `{"key_size": 2048}` alone returns an honest assessment of that RSA key size (no network scan). Any RSA or ECC key size is breakable by Shor's algorithm; key exchange is what needs upgrading.
- Buying the full report ($49.00): `POST https://ather-quatum.cloud/api/v1/orders` with `{"scan_id": "...", "consent_immediate_delivery": true}` (set the flag only after the payer expressly agreed to immediate delivery and to losing the right of withdrawal) returns a PayPal `approve_url` and a `status_url`. After the payer (or an agent the payer authorized in PayPal) approves, the site captures and verifies the payment automatically, and `GET status_url` returns `report_url`.
- Paying with stablecoins instead: `POST https://ather-quatum.cloud/api/v1/crypto/orders` with `{"scan_id": "...", "network": "polygon-usdt" | "arbitrum-usdc", "consent_immediate_delivery": true}` returns a unique `amount` and a `pay_to` address. Send exactly that amount (USDT on Polygon PoS or native USDC on Arbitrum One), then `POST verify_url` with `{"tx_hash": "0x..."}`; the server checks the transfer on-chain and returns `report_url` once confirmed (HTTP 202 while confirming).
- OpenAPI description: https://ather-quatum.cloud/openapi.yaml

## Grades

- A: TLS 1.3 with hybrid post-quantum key exchange.
- B: TLS 1.3 with classical key exchange only (exposed to harvest-now-decrypt-later).
- C: no TLS 1.3.
- F: invalid certificate, legacy TLS, static RSA key exchange or RSA below 2048 bits.

## Research

- https://ather-quatum.cloud/research — a 3-qubit GHZ circuit run on IBM Quantum hardware (ibm_marrakesh) and a research report archived as digital DNA with Reed-Solomon error correction.

## Guides and data

- https://ather-quatum.cloud/study/top-1000-post-quantum-tls — scan of the Tranco top 1,000 domains (November 2026): share that negotiate X25519MLKEM768, grade distribution, full per-domain table. Raw data: https://ather-quatum.cloud/study/top-1000-post-quantum-tls.json (CC BY 4.0).
- https://ather-quatum.cloud/adoption — weekly tracker: every Monday the Tranco top 10,000 and watchlists of government, bank and company sites in Germany, Austria and Switzerland are re-scanned (the top 100,000 monthly); shows which sites switched to or lost X25519MLKEM768 that week and the share of sites ready per hosting provider / CDN network. Data: https://ather-quatum.cloud/adoption.json and https://ather-quatum.cloud/adoption.csv (CC BY 4.0).
- https://ather-quatum.cloud/guides/enable-x25519mlkem768-nginx — enable post-quantum TLS on nginx (OpenSSL 3.5+) and verify it.
- https://ather-quatum.cloud/guides/post-quantum-tls-apache-caddy-haproxy-cloudflare — the same for Apache, Caddy, HAProxy and Cloudflare.
- https://ather-quatum.cloud/guides/harvest-now-decrypt-later — why key exchange must be upgraded before certificates.

## Ranking by country

- https://ather-quatum.cloud/adoption/countries — share of each country's top websites (country-code domains in the Tranco top 10,000) that negotiate X25519MLKEM768, with weekly change; one page per country at https://ather-quatum.cloud/adoption/countries/{cc} (e.g. /adoption/countries/de). Data: https://ather-quatum.cloud/adoption/countries.json (CC BY 4.0).

## Agency pack

- https://ather-quatum.cloud/agency — 10 full reports for $199 (one payment, no expiry): after paying, a private pack page lets you scan any domain and open its full report immediately, one credit each.

## Monitoring subscription (for teams)

- https://ather-quatum.cloud/monitoring — daily scans of up to 10 domains ($29/month) or 100 domains ($99/month) with email alerts when post-quantum key exchange is lost, a grade changes, or a certificate nears expiry. Billed monthly through PayPal; cancel any time.

## Badge

- https://ather-quatum.cloud/badge/{domain}.svg — embeddable SVG badge showing a domain's latest grade from the last 30 days (grey "not scanned" otherwise). Link it to https://ather-quatum.cloud/?domain={domain}.

## Per-domain pages and comparison

- https://ather-quatum.cloud/site/{domain} — public, indexable page with a domain's latest known grade (from a recent scan or the top-1000 study) and a ready badge snippet.
- https://ather-quatum.cloud/compare?a=sitea.com&b=siteb.com — scan two sites side by side.
- CLI: `npx quantum-aether {domain}` (Node ≥18) prints the grade in your terminal; `--json` for machine output.
- GitHub Action: `uses: moncef00327-cloud/pq-tls-action@v1` with `domain:` checks post-quantum TLS on every deploy; optional `require-post-quantum: true` fails the job if X25519MLKEM768 is missing. Marketplace: https://github.com/marketplace/actions/post-quantum-tls-check-quantum-aether