Hybrid key exchange in HAProxy

Settings that make a server prefer a hybrid key exchange group. Group names differ by product, and hybrid groups need a TLS library that includes them (OpenSSL 3.5 or later, BoringSSL, Go 1.24 or later).

Prefer the hybrid group

global
    ssl-default-bind-curves X25519MLKEM768:X25519:P-256

Allow only post-quantum groups

global
    ssl-default-bind-curves MLKEM768:X25519MLKEM768
    ssl-default-bind-options ssl-min-ver TLSv1.3

Native ML-KEM first, hybrid second: browsers offer only the hybrid group, so a list with MLKEM768 alone refuses them. Clients that offer no post-quantum group are refused.

Log the negotiated group

frontend https
    log-format "%ci %[ssl_fc_protocol] %[ssl_fc_cipher] %[ssl_fc_curve]"

Keep legacy clients on a separate listener

frontend https
    bind :443 ssl crt /etc/haproxy/site.pem
    bind :8443 ssl crt /etc/haproxy/site.pem curves X25519:P-256

Notes for HAProxy

ssl_fc_curve logs the negotiated group. A TLS 1.2 connection logs its classical group. A bind line with its own curves option gives legacy clients a separate listener.

Checked in a lab with HAProxy 3.4.7, OpenSSL 4.0 on Oct 18, 2026.

Other servers

nginx, Apache httpd, Envoy, OpenSSL, Go crypto/tls, OpenSSH sshd, Java JSSE, IIS (Windows Schannel).

Back to perspectives