Needs: (check: the first JDK release whose TLS stack offers X25519MLKEM768) · Not yet tested on a real server

Enable X25519MLKEM768 in Java

Java's built-in TLS (JSSE) gains hybrid post-quantum key exchange in recent JDK releases. (check: the JDK version and whether it is on by default.) If your Java service sits behind a load balancer or CDN that terminates TLS, configure that instead.

Before you start

Option 1: keep the defaults

  1. Look for a group list your service sets: search your start-up flags and code for jdk.tls.namedGroups and setNamedGroups.
  2. If nothing sets it, upgrade to a JDK that offers X25519MLKEM768 and restart the service.

Option 2: list the groups yourself

  1. Put X25519MLKEM768 first in the system property (check: the exact group name JSSE accepts):
-Djdk.tls.namedGroups=X25519MLKEM768,x25519,secp256r1
  1. Restart the service, then scan your domain below.

Check the change

Scan your domain to see whether every host now uses post-quantum key exchange.

Related check: Does my server support X25519MLKEM768?