After RFC 10024 Takes Effect in 2026, How Do You Verify ML-KEM TLS 1.3?

RFC 10024 defines two named hybrid key-agreement groups for TLS 1.3, including X25519MLKEM768 and SecP256r1MLKEM768 (RFC 10024). That is a protocol option, not proof that any particular client, server, library, or network path has enabled it. The safer choice is to verify the negotiated group in a controlled test, then test compatibility and fallback before expanding rollout; a configured algorithm name alone is not acceptance evidence.

This guide is for engineers changing a TLS 1.3 client or server and needing a repeatable test plan.
SREs planning release and rollback can use the checkpoints to bound deployment risk.
Teams maintaining security test environments can use the timeline to structure reproducible runs.

Last updated October 1, 2026. The standard reference was checked against the IETF RFC 10024 publication; implementation-specific steps must also be checked against the official documentation for the TLS library and endpoints actually under test.

Set the test boundary before changing configuration

RFC 10024 specifies hybrid key agreement for TLS 1.3. It does not mean every cryptographic part of a TLS connection has been migrated to post-quantum algorithms. In particular, a hybrid key exchange does not, by itself, establish that certificates, signatures, or all other cryptographic choices in the connection are post-quantum. The TLS 1.3 specification, RFC 8446 describes the protocol’s handshake and key exchange context; read RFC 10024 alongside it rather than treating a new group as a replacement for the entire TLS security stack.

For a deployment decision, separate these questions:

• Does the client offer the intended hybrid group?
• Does the server accept and select it?
• Can the path between them carry the handshake successfully?
• If the hybrid option is unavailable, does the connection fail, select another permitted group, or follow some implementation-specific path?
• Are the remaining certificate and signature choices acceptable under the organization’s migration policy?

The framework for combining traditional and post-quantum key establishment is also described in RFC 9954. That framework helps explain the hybrid approach, but it does not certify a particular product’s support or default settings. Confirm those against the vendor or project documentation for the exact client, server, TLS library, proxy, and load balancer in scope.

What does RFC 10024 change for a TLS client and server? The client needs an implementation that can offer a supported hybrid group; the server needs an implementation that can process and select it. Neither role can infer success from the peer’s configuration file. The observable result in an actual handshake is the decisive evidence.

Before running tests, write down the boundary: endpoint versions, TLS libraries, configuration source, network path, and whether the run is isolated from production traffic. Include any TLS-terminating proxy or load balancer. A test directly between a library’s sample client and a server may prove those two endpoints can negotiate; it does not establish that a production path with an intermediary behaves the same way.

Prepare a controlled client, server, and network path

Start with a small test matrix rather than changing a live listener. Verify support independently on each side using official documentation for the software in use. Record the version and relevant configuration state, including any group allowlist, policy setting, or build option that controls supported groups. Do not infer that a product enables a group by default because the RFC defines it.

The word “support” can describe different capabilities: a library may recognize a group, a command-line tool may expose it, and a product may still disable it through its policy or build. Check which layer owns the setting and where the setting takes effect. Also record whether TLS terminates at the application, a reverse proxy, an ingress gateway, or a managed load balancer. The visible endpoint may not be the component performing the handshake.

For OpenSSL-based systems, consult the official group-configuration and negotiated-group API documentation for the APIs and group handling available in the relevant release. Use the documentation that matches the installed version; do not copy an API name or configuration example from another release and assume identical behavior. If the endpoint uses a different TLS implementation, use that implementation’s own documentation and diagnostics.

Use a non-production listener or an isolated test service when possible. Keep the test client and server identities distinct from production, and ensure the test path has the same relevant intermediaries as the path being assessed. If that is not possible, state the difference in the test record. A successful direct connection is useful evidence, but it cannot answer questions about an untested proxy or traffic route.

A configuration setting is evidence of intent. A recorded handshake result is evidence of what that specific test connection negotiated.

At this stage, agree on what counts as pass, fail, and rollback. For example, define which client populations must connect, which group selection is required for a canary, and what failure signals stop expansion. Avoid a universal rule such as “enable the group everywhere”: permitted fallback and rollout thresholds depend on the supported endpoint population and the organization’s risk controls.

Verify the negotiated group in a real handshake

A configuration entry that names X25519MLKEM768 does not prove that a connection used it. The client may not have offered it, the server may not support it, or a network intermediary may change the handshake path. Confirm the result from diagnostics that report the group selected for the specific connection. Where the TLS library exposes negotiated-group information, use the official API documentation and capture that value alongside the connection’s endpoint and timestamp.

How can you confirm that a TLS 1.3 connection negotiated X25519MLKEM768? Run a test from a client whose offer is known, connect to the intended server endpoint, and inspect the negotiated-group output from a supported diagnostic or library API. Confirm that the output identifies the hybrid group, not merely TLS 1.3 as the protocol version. Save the output or structured log with the test record so another engineer can review it.

The group name identifies a hybrid construction, not a blanket property of the full connection. The NIST FIPS 203 specification for ML-KEM defines ML-KEM parameter sets named ML-KEM-512, ML-KEM-768, and ML-KEM-1024. X25519MLKEM768 uses the ML-KEM-768 component alongside X25519 as specified for the TLS group; the “768” in the group name is not a performance guarantee or a measure of connection speed.

For each test, distinguish client-side evidence from server-side evidence. Client output can show what that client offered and reports as selected. Server logs may establish what the server saw, subject to the server’s logging detail. If the two disagree or one side omits the group, do not silently treat the run as successful. Check whether the diagnostic is reporting the actual selected group, a supported-group list, or a local configuration value.

Also check that you are testing the intended TLS version. A TLS 1.3 group negotiation result should not be conflated with a TLS 1.2 connection or with a different protocol endpoint. Capture the protocol version and negotiated group together. If the diagnostic tool cannot reliably expose the group, use a supported API or another officially documented diagnostic path rather than inferring it from a configuration file.

Test compatibility, fragmentation, and fallback paths

Once the intended group has been observed in a controlled handshake, test the combinations that the service must support. Include current clients and older clients still in the supported population, plus the actual proxy or load-balancer route where one exists. Test both successful hybrid negotiation and expected behavior when one side cannot use that group.

How should you investigate handshake failures or fallback after enabling ML-KEM? Record the negotiated group, the stage where the handshake stopped, the endpoint versions, and the network path. Then repeat with one controlled variable changed: for example, compare a direct path with the intermediary path, or a client known to offer the hybrid group with one that does not. A single successful retry does not identify the cause or prove compatibility across the fleet.

Test for failures that can be specific to the complete handshake exchange, including intermediaries that inspect, buffer, or limit handshake data. Do not assume every network device handles a changed handshake message in the same way as the endpoints. Where a connection fails, capture the relevant client and server diagnostics and identify whether the failure occurred before group selection, during key agreement, or later in the handshake. Keep any packet capture or sensitive handshake material within the team’s security and retention policy.

Fallback requires an explicit expectation. If a client or server cannot use the hybrid group, determine whether the implementation can negotiate an allowed alternative and whether that behavior complies with policy. A fallback that preserves availability may not meet a requirement that a particular connection use hybrid key agreement. Conversely, a strict failure may be acceptable for a controlled test but disruptive if applied to an unknown client population. Verify the actual behavior for the specific implementations; RFC support alone does not establish the application’s fallback settings.

What compatibility tests belong in a post-quantum TLS rollout? At minimum, test the supported client population against the target server, test the production-relevant intermediary route, and test both the intended hybrid negotiation and the expected outcome when it is not available. Include connection failure diagnosis and a rollback rehearsal. This is more informative than marking a release “compatible” after one successful connection.

For each failed run, note the client and server implementation and version, the route, the protocol version if available, the selected group if any, and the earliest known failure stage. Also record whether the test was repeated with a known-good baseline. That helps separate a group negotiation issue from a certificate, policy, application, or network problem.

Turn results into a release decision

Do not expand deployment because a configuration change appears syntactically valid or because one endpoint pair passed. Compare observed results against the client groups and routes that the service must support. Keep the decision reversible: begin with a test environment or a narrowly scoped canary, review connection failures and negotiated-group evidence, then expand only if the agreed acceptance conditions hold. If the evidence is incomplete, pause expansion rather than treating lack of reported errors as proof of success.

A useful record should let a second engineer reproduce the test without guessing what “enabled” meant. Capture the exact client and server implementations and versions, the TLS library where relevant, the endpoint and route, the negotiated protocol and group, the outcome, and any failure stage. Attach the relevant diagnostic output and note which official documentation was used to interpret it. Include the rollback trigger and the person or release process authorized to act on it.

The matrix below is a decision aid, not a claim that every product behaves alike. Fill it with observed results for the actual versions under test.

Test option	Key decision dimension	Evidence to retain	Release implication
Direct client-to-server test	Can these endpoint implementations negotiate the intended group?	Both implementation versions, protocol, selected group, diagnostics	Validates the pair only; does not cover intermediaries
Test through the production-relevant proxy or load balancer	Does the real path preserve successful negotiation?	Route, intermediary version or configuration, handshake result, failure stage	Required before claiming that the route is compatible
Client without the hybrid group	Does the server follow the approved fallback or failure policy?	Client capabilities, resulting group or failure, server logs	Confirms whether older or restricted clients remain supported
Controlled canary	Does the change behave acceptably for the chosen release scope?	Scope, observations, acceptance decision, rollback trigger	Expand only when the recorded criteria are met

Before promotion, review the record for missing cases, not just passed cases. If the test covered a library’s direct handshake but not the service’s actual TLS termination point, the untested production boundary should remain visible in the release decision. If the service population includes clients whose versions or group capabilities are unknown, gather that inventory or restrict the rollout until the uncertainty is bounded.

Apply the checklist before expanding rollout

• [ ] The RFC-defined behavior has been separated from product-specific support and default settings.
• [ ] Client, server, TLS library, and any TLS-terminating intermediary have been identified and checked against their own official documentation.
• [ ] The test path is recorded, including any difference from the production path.
• [ ] The test confirms the negotiated group for an actual handshake rather than relying on a configuration entry.
• [ ] The protocol version and group result are recorded together.
• [ ] Compatibility has been checked for the required client population and intermediary route.
• [ ] Failure stage and fallback behavior have been observed and compared with policy.
• [ ] Acceptance conditions, rollback triggers, and the release decision are recorded.

The right rollout choice depends on what the evidence shows: expand only when the intended group is confirmed on the relevant path and the compatibility and fallback results meet policy; otherwise, keep the change in the test boundary and investigate the missing case. There is no standards-based performance threshold here that applies to every implementation, so do not substitute an assumed latency or throughput figure for observed service behavior.

For this work, a local VM or shared Linux test host can be quick to reuse, but it may not represent the macOS client environment, and shared environments can make it harder to isolate a failure to one endpoint or path. Buying dedicated hardware gives you more control, but creates procurement, maintenance, and idle-capacity costs. When the test plan specifically needs a temporary macOS endpoint, renting a Mac can provide a more convenient way to run that client-side check without treating a local Linux environment as equivalent. That does not replace testing the production server path, and it is not a fit when the workload needs a permanently controlled machine or physical interfaces. Check the Mac mini rental options for the available service details, and use the help center to confirm whether a proposed test setup is suitable; no TLS capability or test configuration should be assumed without confirmation.