How to enable post-quantum cryptography and TLS termination with HAProxy

blog20260701-01.cfg

global
  ssl-default-bind-options ssl-min-ver TLSv1.3 no-tls-tickets
  ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
  ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

  # Server-side defaults
  ssl-default-server-options ssl-min-ver TLSv1.3
  ssl-default-server-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

  # Hybrid Post-Quantum Curves (priority order)
  ssl-default-server-curves X25519MLKEM768:SecP256r1MLKEM768:X25519:P-384:P-256
  ssl-default-bind-curves   X25519MLKEM768:SecP256r1MLKEM768:X25519:P-384:P-256

  log-send-hostname

defaults unnamed_defaults_1
  timeout http-request 5s
  timeout connect 5s
  timeout client 30s
  timeout server 10s

frontend fe_https
  bind *:443 crt /var/lib/dataplaneapi/storage/certs/site.pem ssl force-strict-sni
  http-request redirect scheme https unless { ssl_fc }
  default_backend be_web

backend be_web
  option forwardfor
  http-request return status 200 content-type text/plain string "Hello from HAPEE PQ test\n"

blog20260701-02.cfg

X25519MLKEM768:SecP256r1MLKEM768:X25519:P-384:P-256

blog20260701-03.bash

printf "GET / HTTP/1.1\r\nHost: haproxyrocks.com\r\n\r\n" | \
/opt/hapee-3.2/usr/bin/bssl s_client \
  -curves SecP256r1MLKEM768 \
  -connect 192.168.0.1:443

blog20260701-04.bash

Connecting to haproxyrocks.com:443
Connected.
  Version: TLSv1.3
  Resumed session: no
  Cipher: TLS_AES_128_GCM_SHA256
  ECDHE group: SecP256r1MLKEM768
  Signature algorithm: rsa_pss_rsae_sha256
  ...
HTTP/1.1 200 OK
content-length: 25
content-type: text/plain

Hello from HAPEE PQ test

blog20260701-05.cfg

Client + Server → Hybrid Key Exchange → Shared Secret