Is your TLS ready for the quantum era?

What this SSL test checks

This scanner runs every class of check you know from Qualys SSL Labs — certificate chain and trust, protocol support from SSLv2 through TLS 1.3, cipher suites and forward secrecy, and the full battery of known vulnerabilities (Heartbleed, ROBOT, POODLE, DROWN, Logjam, SWEET32 and more) — and then goes further with checks SSL Labs doesn't offer:

• Post-quantum readiness — can your server negotiate the X25519MLKEM768 hybrid key exchange that Chrome, Firefox and Safari already use? Encrypted traffic recorded today can be decrypted by future quantum computers unless your key exchange is quantum-resistant now.
• HTTP/3 (QUIC) — the transport that eliminates head-of-line blocking on lossy networks.
• Encrypted Client Hello (ECH) — closing the last plaintext metadata leak in TLS.
• TLS handshake latency — security config is performance config.
• Exact NGINX fixes — every finding comes with the configuration directive that fixes it, not just a description of the problem.

How grading works

The letter grade follows the well-known SSL Labs rating model: protocol support, key exchange strength and cipher strength are scored and weighted, with hard caps for weaknesses (legacy TLS 1.0/1.1 caps at B, missing forward secrecy caps at B, RC4 or 3DES caps at C) and automatic failure for exploitable vulnerabilities or untrusted certificates. An A+ additionally requires long-duration HSTS.

The separate Future-Proof Score measures readiness for where TLS is going: post-quantum key exchange, TLS 1.3, HTTP/3, ECH, and legacy protocols being fully disabled. A site can be perfectly secure today and still score low here — that's your roadmap.

Not post-quantum ready?

Post-quantum key exchange needs NGINX linked against OpenSSL 3.5+. Distribution packages won't have this for years — GetPageSpeed repositories ship always-fresh NGINX built against OpenSSL 3.5 with ML-KEM support today, for every major Linux distro. One dnf install nginx away.

FAQ

Is this test free?

Yes, unlimited and free. Results are cached for 24 hours; use the refresh option after changing your configuration.

How is this different from SSL Labs?

Same core checks, plus post-quantum, HTTP/3 and ECH testing that SSL Labs doesn't do — and every finding includes the exact NGINX directive to fix it.

Does my NGINX support X25519MLKEM768?

Only if it is linked against OpenSSL 3.5 or newer. Run nginx -V and look at the built with OpenSSL line: anything below 3.5 has no ML-KEM, so the hybrid group cannot be negotiated no matter what ssl_ecdh_curve says. This test answers it from the outside by attempting a real X25519MLKEM768 handshake against your server.

How do I enable post-quantum TLS in NGINX?

Two steps. First get an NGINX built against OpenSSL 3.5 — GetPageSpeed repositories ship one for every major Linux distro. Then list the hybrid group first: ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1; and reload. Re-run this test to confirm the server actually negotiates it.

Do you store scan results?

Results are kept for 90 days so shareable links keep working, then deleted automatically.

What does the deep scan do to my server?

It performs standard TLS handshakes — the same thing every visiting browser does, just with varied parameters. It never exploits anything; vulnerability checks are non-intrusive probes.