Post-quantum key exchange on Azure Front Door

Azure Front Door terminates TLS at Microsoft's edge, so the key exchange browsers get is decided there, not on your origin. (check: confirm whether Front Door negotiates X25519MLKEM768 today, and whether it is on by default or needs a TLS policy setting.)

Before you start

• A Front Door Standard or Premium profile with your custom domain.

Steps

1. In the Azure portal, open your Front Door profile, then Domains, and choose your domain.
2. Check the minimum TLS version: TLS 1.2 or 1.3 (post-quantum key exchange needs TLS 1.3 support at the edge). (check: the exact setting name and where any TLS policy for groups lives.)
3. Save, wait for the change to deploy, then scan your domain below.

Behind the edge

Front Door connects to your origin separately. Turn on post-quantum key exchange on the origin too, with the guide for your server (for example nginx or Apache).