Settings that make a server prefer a hybrid key exchange group. Group names differ by product, and hybrid groups need a TLS library that includes them (OpenSSL 3.5 or later, BoringSSL, Go 1.24 or later).
Prefer the hybrid group
Enable-TlsEccCurve -Name "X25519_MLKEM768" -Position 0Notes for IIS (Windows Schannel)
Not tested in a lab: no Windows host was available. Taken from Microsoft’s Windows TLS 1.3 and post-quantum FAQ (September 2026). Needs Windows Server 2025 with KB5099536 or later; hybrid groups are off by default and need TLS 1.3. The group is named X25519_MLKEM768 here, and the cmdlet is Enable-TlsEccCurve (not Set-TlsEccCurveOrder). Group Policy overrides the cmdlet, so use one of the two. SecP256r1_MLKEM768 and SecP384r1_MLKEM1024 are also available. A pure ML-KEM update exists as a preview (KB5120998) and was not checked. How to allow only post-quantum groups, and whether Schannel events record the negotiated group, are unverified; Microsoft suggests a packet capture to confirm the group.
Checked against the product documentation on Oct 18, 2026.
Other servers
nginx, Apache httpd, HAProxy, Envoy, OpenSSL, Go crypto/tls, OpenSSH sshd, Java JSSE.