Settings that make a server prefer a hybrid key exchange group. Group names differ by product, and hybrid groups need a TLS library that includes them (OpenSSL 3.5 or later, BoringSSL, Go 1.24 or later).
Prefer the hybrid group
-Djdk.tls.namedGroups=X25519MLKEM768,x25519,secp256r1Allow only post-quantum groups
-Djdk.tls.namedGroups=X25519MLKEM768
-Djdk.tls.server.protocols=TLSv1.3Notes for Java JSSE
Needs JDK 27 or later: JDK 25.0.2 accepts the hybrid name in jdk.tls.namedGroups but never offers it. JSSE has no native ML-KEM TLS group; MLKEM768 in the list is ignored, so the list is hybrid groups only. The property is read once at startup. SSLSession has no group accessor, and the jdk.TLSHandshake JFR event (enable it explicitly) records peer, protocol and cipher but not the group. -Djavax.net.debug=ssl
prints the group but is too verbose for production.Checked in a lab with OpenJDK 27 on Oct 18, 2026.
Other servers
nginx, Apache httpd, HAProxy, Envoy, OpenSSL, Go crypto/tls, OpenSSH sshd, IIS (Windows Schannel).