The state of post-quantum readiness on the web

Methodology

Once a month we perform a single read-only TLS handshake to each host in a fixed public panel and record whether the server selects the hybrid group X25519MLKEM768, the negotiated TLS version, and the leaf certificate’s signature algorithm and expiry. We never send more than one connection per host per run, we honor connection refusals, and we do not attempt any exploitation. This is the same class of measurement public scanners such as SSL Labs and Censys perform.

The panel and the probing policy are documented alongside our open-source qProbe tooling. To have a host removed from the panel, contact [email protected] and we will drop it within one measurement cycle.