Settings that make a server prefer a hybrid key exchange group. Group names differ by product, and hybrid groups need a TLS library that includes them (OpenSSL 3.5 or later, BoringSSL, Go 1.24 or later).
Prefer the hybrid group
SSLProtocol -all +TLSv1.3 +TLSv1.2
SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519:secp256r1Allow only post-quantum groups
SSLProtocol -all +TLSv1.3
SSLOpenSSLConfCmd Groups MLKEM768:X25519MLKEM768Native ML-KEM first, hybrid second: browsers offer only the hybrid group, so a list with MLKEM768 alone refuses them. Clients that offer no post-quantum group are refused.
Notes for Apache httpd
mod_ssl has no log variable for the negotiated group. To confirm the setting, connect with a test client that offers only the hybrid group. Needs a build against OpenSSL 3.5 or later.
Checked in a lab with Apache httpd 2.4.69, OpenSSL 4.0 on Oct 18, 2026.
Other servers
nginx, HAProxy, Envoy, OpenSSL, Go crypto/tls, OpenSSH sshd, Java JSSE, IIS (Windows Schannel).