TLS connections fail with "ERR_CONNECTION_RESET" after a browser update

When browsers started offering post-quantum key exchange, some sites began failing with "ERR_CONNECTION_RESET" (or a similar "connection was reset" or "network connection was lost" error) for new browser versions only. (check: the messages Safari on iOS 26 and current Chrome show.)

Why it happens

The browser's first message, the ClientHello, carries an ML-KEM key share and grows past one network packet. Some firewalls, load balancers and old TLS stacks assume it fits in one packet and drop the connection.

How to check

1. Scan your domain with our client compatibility checker: it sends the large ClientHello browsers send and flags hosts that drop it.
2. Compare with a classical handshake from the same machine:

openssl s_client -connect yourdomain.com:443 -groups X25519 </dev/null
openssl s_client -connect yourdomain.com:443 -groups X25519MLKEM768 </dev/null

If the first works and the second fails or hangs, something on the path drops large ClientHellos.

Fix it

1. Update the firewall, load balancer or TLS library in front of the host; vendors fixed this as browsers rolled out post-quantum key exchange.
2. Re-run the check until the host shows the large ClientHello as accepted.