Your HTTPS May Already Be Post-Quantum. Your Certificate Isn't.
You've probably seen "post-quantum" around lately and wondered what it actually means for your site. You're not alone.
What post-quantum means
Post-quantum means built to hold up against a quantum computer. The math behind today's HTTPS is too hard for normal computers, but a big enough quantum computer could solve it. Nobody is known to have one yet.
So why bother now? Someone can record encrypted traffic today and sit on it. If a quantum computer can break it ten years from now, that recording opens up. Post-quantum protection stops that, but only for traffic sent after you have it.
Two jobs
An HTTPS connection does two separate jobs, and only one of them has gone post-quantum so far.
| Job | What it does | Post-quantum today? |
|---|---|---|
| Key exchange | Your browser and the site agree on a secret that scrambles the traffic | Yes, mostly at big sites and CDNs |
| Certificate | Proves the site is really that site | Not yet on public websites, as far as we can tell |
Think of a phone call. The key exchange scrambles the line so nobody can listen in, and the certificate is the caller ID.
Where key exchange stands today
Browsers have already moved. Most major ones now prefer X25519MLKEM768, which is just the old method (X25519) and a new one (ML-KEM) used together. Cloudflare said in September that about 70% of the browser traffic reaching its network uses this kind of hybrid. That's Cloudflare's traffic, not the whole internet.
We wanted our own number, so on October 29 we scanned the top 1,000 domains on Tranco, a research ranking of the most popular domains. We tried each domain with and without www, and counted it if either one qualified.
| Result | Domains |
|---|---|
| No TLS 1.3, or no answer | 345 |
| Spoke TLS 1.3 | 655 |
| Accepted post-quantum key exchange | 522 (79.7% of the 655) |
| Accepted it both with and without www | 364 |
These are the most popular domains, and many of them use a CDN, a big network that sits in front of a site and answers visitors for it. So don't read 79.7% as the whole web. Behind the CDN it's a different picture: Cloudflare says only about 15% of the sites' own servers it connects to use post-quantum.
How a smaller server gets it
By accident, if ours is anything to go by. When we built our post-quantum tool on October 28, we ran our own site through it and it said no. We expected that, and put it on our to-do list. A few days later it said yes. We hadn't touched that to-do yet, so we figured the tool had a bug.
It didn't. On October 31 we'd upgraded the server to Debian 13, which comes with OpenSSL 3.5, and Apache picked it up from OpenSSL. We never changed a setting for it.
We'd guess plenty of servers will get it the same way, on some routine upgrade, and nobody will notice. OpenSSL 3.5 and newer offer it by default. The exception is a web server whose config sets its own list of key exchange groups: that list needs X25519MLKEM768 added, or the upgrade won't help.
Certificates are still a way off
Certificates don't have that recording problem. As Let's Encrypt puts it, a quantum computer has to forge a signature in real time, not retroactively. That's why they could wait.
As far as we can tell, you can't yet get a post-quantum certificate that browsers will trust for a public website. Size is a big part of why: an ML-DSA-44 signature is roughly 2,420 bytes, against about 70 for ECDSA P-256, and a TLS handshake carries several signatures.
Let's Encrypt plans to use Merkle Tree Certificates, which keep the handshake smaller. It's aiming for a staging environment in late 2026 and production in 2027. We'll see.
So when a tool says a site is post-quantum, it almost certainly means the key exchange. The certificate is still RSA or ECDSA, and that's fine. Post-quantum key exchange works with the certificate you already have.
Where CertAvert fits
CertAvert checks your certificates from the outside and emails you before one expires. The post-quantum result is now on each domain's TLS tab too. On Pro it's also printed in your certificate report, with how many days it was accepted, so you've got something to show off to your auditor.
Check yours
Put both the www and non-www versions of your domains through the free post-quantum tool. They can give different answers: in our scan, 158 domains accepted it on only one of the two. It takes a few seconds and doesn't need an account.