Topic
The transport-layer protocol that encrypts most web and API traffic, negotiating key exchange and server identity at the start of every connection.
Cloudflare reports origin handshake retries falling by a factor of fourteen, though its own 30% miss rate cannot produce a 52% baseline. What does transfer is post-quantum key agreement arriving with nobody configuring it.
Reality
AWS and Microsoft are already shipping ML-KEM hybrid groups, so the question for platform teams is whether the old proxy, SDK and appliance in the path still complete a handshake that got bigger.
Reality
Probing each origin for its preferred key agreement group dropped HelloRetryRequests on scanned origins from about 52% to 3.7% and took more than 150 ms off p90 handshakes, after the price of the old classical-first default had climbed 25-fold since 2023.
Reality
Oracle's JDK 27 release notes put hybrid post-quantum key exchange for TLS 1.3 into the default configuration. The migration now belongs to whoever schedules the runtime upgrade.
Reality
Christian Pfister says quantum safety entered the bank's risk meetings in 2022, and the live pilot's problems turned up in load balancers and content delivery networks along the path between customer and server.
Reality
JEP 527's hybrid key exchange landed as a stable feature on September 15, and the same JDK makes G1 the collector on small machines and cuts every object header to 64 bits. Serial is still one flag away.
Perspective Coverage
4 publishersReality
A developer dumped the ClientHello that openssl sends and found the requested hostname in plain ASCII inside the server_name extension. A listener holding no private key read it back off the wire, TLS 1.3 included.
Reality