This is a real, complete report for github.com, exactly as a buyer receives it after payment, from a scan run on 2026-11-03. The result changes if the site changes its configuration.
Post-quantum readiness report
Secure today, exposed to harvest-now-decrypt-later
Scanned at: 2026-11-03T08:58:57+00:00 · IP 20.26.156.215
We offered X25519MLKEM768, as Chrome and Firefox do, and the server chose x25519. That is secure today, but traffic recorded now could be decrypted once a quantum computer can run Shor's algorithm ("harvest now, decrypt later"). This is the most important item to fix for quantum readiness.
Every certificate algorithm in use today (RSA, ECDSA, EdDSA) falls to a large quantum computer at any key size; moving to RSA-4096 does not help. It is less urgent than key exchange because impersonation needs the quantum computer at connection time and cannot be done retroactively. The long-term fix is ML-DSA (FIPS 204) certificates once CAs and browsers support them; until then, automate certificate renewal to ease the switch.
You need a TLS library with ML-KEM. Quickest routes: upgrade to OpenSSL 3.5 or newer, use a server built with Go 1.24+, or put a proxy such as Cloudflare in front of your site.
# check first: nginx -V 2>&1 | grep -o 'OpenSSL [0-9.]*' (needs 3.5 or newer)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:prime256v1# X25519MLKEM768 is enabled by default in Go 1.24+ crypto/tls.
# Upgrade Caddy (or your Go server) to a build made with Go 1.24 or newer.# Cloudflare negotiates X25519MLKEM768 with browsers by default.
# Proxy the domain through it (orange cloud) and scan again.After changing the configuration, scan again here to confirm the grade is A.
| TLS (probe) | TLSv1.3 |
|---|---|
| Key exchange group | x25519 |
| Cipher suite (probe) | TLS_AES_128_GCM_SHA256 |
| Post-quantum ClientHello accepted | True |
| TLS (standard handshake) | TLSv1.3 · TLS_AES_128_GCM_SHA256 |
| Certificate key | ECDSA-256 (secp256r1) |
| Signature algorithm | ecdsa-with-SHA256 |
| Subject / Issuer | github.com / Sectigo Limited |
| Valid until | 2027-01-27T23:59:59+00:00 (85 days) |
| Chain verified | True |
| SANs (2) | github.com, www.github.com |
| Scanner | v2.0 |