Hybrid Post-Quantum TLS Explained, with a Finland Sample

When a browser connects to a site over TLS 1.3, both sides agree on a shared secret through a key exchange. Hybrid post-quantum TLS combines the classical X25519 exchange with ML-KEM-768, the lattice-based method standardised by NIST as FIPS 203, in one group called X25519MLKEM768. The exchange stays secure if either part holds; the design aim is that traffic recorded today cannot be decrypted later by a quantum computer. This guide explains how we test a host for it and what a sample of Finnish sites negotiates; it is not a rating of anyone's overall security.

Published by Caliper Press · Page updated Oct 18, 2026

What "hybrid post-quantum TLS" means here

For years the usual key exchange group has been X25519, an elliptic-curve method. A sufficiently large quantum computer could break it, and traffic recorded today could be decrypted later. X25519MLKEM768 adds ML-KEM-768 to it; the connection is secure if either component holds, which is why it is called hybrid.

This is only the key agreement. Certificates and signatures in the same connection are still classical; post-quantum certificates are a separate, later step. A "Yes" in our data means the host negotiated the hybrid key agreement with our client, not that the organisation is quantum-safe as a whole.

Cipher suites and key exchange groups

A TLS 1.3 cipher suite, such as TLS_AES_128_GCM_SHA256, names only the symmetric encryption and the hash used after the handshake. The key exchange group, such as X25519 or the hybrid X25519MLKEM768, is negotiated separately, in the supported_groups and key_share extensions. Post-quantum protection of the session keys comes from the group, not from the cipher suite, so hybrid key exchange needs no new cipher suite.

Our numbers

On Oct 18, 2026, 82.7% of the hosts we measured negotiated X25519MLKEM768 in TLS 1.3 (based on 52 hosts with a valid result). In Finland, 11 of the 15 Finnish hosts with a result negotiated it and 4 did not; 4 of the 19 Finnish hosts gave no valid result. Methodology · All post-quantum TLS results.

How we test a host

We open two independent TLS 1.3 connections to port 443, offering X25519MLKEM768, with certificate and hostname verification. If both connections negotiate the hybrid group, the result is Yes. If the server explicitly rejects it, a second connection offers the hybrid group together with classical groups; two classical results give No. Different results in the two trials, timeouts and certificate or network errors give an unknown result, never No. Results can differ by location and network.

Finland: public bodies, banks and services

The Finnish part of the sample is every host under the .fi domain, 19 in total (Banks: 6; Finnish public sector: 13). Latest result per host:

Finnish hosts that negotiated a classical group only in the latest check: S-Pankki, City of Helsinki, Finnish Tax Administration, Kela. A classical result is a statement about the server configuration at that date; many sites change it when their CDN or TLS terminator is updated, and the change will appear in the host's history.

Adoption by group

Adoption is driven largely by infrastructure providers. When a CDN enables the hybrid group for its customers, every site behind it changes at once, which is why the share among CDN-hosted sites can be high while self-hosted services lag. Hosts in the whole sample that returned a classical group in the latest check: CDN77, City of Helsinki, Deutsche Bank, Finnish Tax Administration, GitHub, Hetzner, Kela, Netlify, S-Pankki.

What we do not test

We test one hostname on port 443 for each site. QUIC or HTTP/3, Encrypted Client Hello, mail servers, connections between a CDN and the origin server and other post-quantum groups are not part of the test. The 60 hosts are an editorial sample of prominent sites, banks, EU and Finnish public bodies, CDN companies and mail providers.

The history spans 22 observation date(s), from Sep 27, 2026 to Oct 18, 2026.

All Post-quantum TLS checks records · Methodology · How to use this data