Hybrid key exchange in OpenSSL

Settings that make a server prefer a hybrid key exchange group. Group names differ by product, and hybrid groups need a TLS library that includes them (OpenSSL 3.5 or later, BoringSSL, Go 1.24 or later).

Prefer the hybrid group

[system_default_sect]
Groups = X25519MLKEM768:X25519:secp256r1

Allow only post-quantum groups

[system_default_sect]
MinProtocol = TLSv1.3
Groups = MLKEM768:X25519MLKEM768

Native ML-KEM first, hybrid second: browsers offer only the hybrid group, so a list with MLKEM768 alone refuses them. Clients that offer no post-quantum group are refused.

Notes for OpenSSL

Applies to every service that reads openssl.cnf and sets no group list of its own. Needs OpenSSL 3.5 or later.

Checked in a lab with OpenSSL 3.6.5 on Oct 18, 2026.

Other servers

nginx, Apache httpd, HAProxy, Envoy, Go crypto/tls, OpenSSH sshd, Java JSSE, IIS (Windows Schannel).

Back to perspectives