CNSA 2.0 and TLS: what vendors get asked
CNSA 2.0 is the NSA's set of approved algorithms for national security systems. It names ML-KEM-1024 for key establishment. (check: the exact algorithm list, parameter sets and dates against NSA's current CNSA 2.0 advisory before publishing.)
What buyers ask
- Whether your service supports post-quantum key exchange today, and on which endpoints.
- Your timeline for CNSA 2.0 algorithms, including ML-KEM-1024 and post-quantum signatures. (check: the milestone years buyers quote.)
- Whether you depend on a CDN or cloud provider for it.
What you can show today
- Scan your domain below: it shows which hosts negotiate post-quantum key exchange and which group.
- Note the difference: browsers and most CDNs use X25519MLKEM768 (hybrid, ML-KEM-768); CNSA 2.0 names ML-KEM-1024. Our ML-KEM checker shows whether a host also accepts SecP384r1MLKEM1024.
- Check a host by hand with OpenSSL 3.5:
openssl s_client -connect yourdomain.com:443 -groups SecP384r1MLKEM1024 </dev/null 2>/dev/null | grep -i group- Answer the questionnaire with what the scan shows; our questionnaire tool drafts the answers.