Settings that make a server prefer a hybrid key exchange group. Group names differ by product, and hybrid groups need a TLS library that includes them (OpenSSL 3.5 or later, BoringSSL, Go 1.24 or later).
Prefer the hybrid group
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;Allow only post-quantum groups
ssl_protocols TLSv1.3;
ssl_ecdh_curve MLKEM768:X25519MLKEM768;Native ML-KEM first, hybrid second: browsers offer only the hybrid group, so a list with MLKEM768 alone refuses them. Clients that offer no post-quantum group are refused.
Log the negotiated group
log_format tls '$remote_addr "$ssl_protocol" "$ssl_cipher" "$ssl_curve" "$ssl_curves"';
access_log /var/log/nginx/tls.log tls;Notes for nginx
Keep one classical group in the list so legacy clients can still connect. nginx cannot choose groups per client address inside one handshake, so use separate listeners for legacy clients. $ssl_curve needs nginx 1.21.5 with OpenSSL 3.0 or later.
Checked in a lab with nginx 1.31.7, OpenSSL 4.0 on Oct 18, 2026.
Other servers
Apache httpd, HAProxy, Envoy, OpenSSL, Go crypto/tls, OpenSSH sshd, Java JSSE, IIS (Windows Schannel).