Check whether your site uses post-quantum TLS

You can check whether your site uses post-quantum TLS by looking at the negotiated key-exchange group in a TLS 1.3 handshake. The usual name is X25519MLKEM768. Chrome, Edge, and Firefox already offer it. Your origin certificate from AutoSSL or Let’s Encrypt can remain ECDSA or RSA; the padlock does not change.

What the handshake is telling you

A TLS 1.3 handshake agrees on a group for the key exchange. Hybrid ML-KEM combined with X25519 is the group current browsers ship. Certificate signatures on the public web are still RSA or ECDSA. Post-quantum signatures are a later change and are not required for this check.

If a CDN sits in front of your site, the browser completes its handshake with that edge. The hop from the CDN to your origin may still be classical. That arrangement is normal and often preferred. Cloudflare’s post-quantum radar shows whether a hostname offers the hybrid group from their edge. It will not show what LiteSpeed on the origin speaks when visitors never reach the origin directly.

How to check with openssl

Run these commands from a machine with a current OpenSSL build. Replace the hostname with your own domain.

openssl s_client -connect example.com:443 -servername example.com /dev/null | openssl x509 -noout -issuer -subject
echo | openssl s_client -connect example.com:443 -servername example.com -tls1_3 2>/dev/null | grep -E ‘Protocol|Cipher|Server public key|Group|Kx=’

You want TLS 1.3 in the output. The group or Kx line is the post-quantum TLS signal. If you only see X25519, the hop you reached does not offer ML-KEM yet. On a LogicWeb origin without a post-quantum-aware edge, a classical handshake is still correct. Do not disable AutoSSL or force unusual ciphers just to chase a group name.

What to change on the origin

In most cases you change nothing on the origin. LiteSpeed and modern OpenSSL pick up hybrid KEM support as packages update over time. There is no separate “enable post-quantum TLS” switch in cPanel. Keep TLS 1.2 and newer enabled, keep AutoSSL current, and avoid pinning old cipher suites in .htaccess.

If Cloudflare sits in front of your site, their edge is likely already doing the hybrid handshake with browsers. Full (strict) SSL to the origin can remain classical. That is a standard setup, not a misconfiguration. HTTP/3 and QUIC is a separate transport on UDP 443 and is related but not the same topic.

Post-quantum TLS shows up as a group name in the handshake. Check it with openssl from more than one place, keep your certificate current, and leave the origin alone unless you have a clear reason to change it. For CDN placement, see Cloudflare in front of LogicWeb.