Mastodawn

looks like you can enable post quantum cryptography in apache on @almalinux 9 and up with one simple config change1

with the ssl config generated by mozilla's tool2 change the line:

SSLOpenSSLConfCmd       Curves X25519:prime256v1:secp384r1

to:

SSLOpenSSLConfCmd       Curves X25519MLKEM768:X25519:prime256v1:secp384r1

and restart the httpd service with sudo systemctl restart httpd, that's it! (a reload may work as well and you wouldn't have any service downtime, but i'm not certain, i would have to test it)

AlmaLinux 9 ships with OpenSSL 3.5.1 by default3 , so you should be all set for PQC

1 https://brnrd.eu/security/2025-03-22/openssl-35-is-pqc-enabled-and-an-lts-release.html
2 https://ssl-config.mozilla.org/#server=apache&version=2.4.62&config=modern&openssl=3.5.0&guideline=5.7
3 https://distrowatch.com/table.php?distribution=alma

#AlmaLinux #AlmaLinux9 #Linux #Apache #OpenSSL #PQC

OpenSSL 3.5 is PQC enabled, and an LTS release.

OpenSSL 3.5 is soon to be released, and brings new Post-Quantum Cryptographic protocols.

brnrd - Bernard Spil

Show thread

Clemens 1d ago

@krishean @almalinux You can do that, but you can also use the method intended to control this by running `update-crypto-policies --set DEFAULT:PQ`. That'll have the advantage that your system will actually use PQC key exchange when connecting to that server...

Show thread

Krishean Draconis 1d ago

@neverpanic @almalinux will that break clients that don't support PQC yet, or will it fall back to an alternative?

Show thread

Clemens

@krishean @almalinux It'll fall back, TLS is a negotiating protocol. This will also give you PQC key exchange in SSH in 9.8, too, again with a fallback, so it's the better choice.

Show thread

Krishean Draconis 1d ago

@neverpanic @almalinux good to know, thanks! i'll enable that on my server