This guide explains how to enable post-quantum key exchange for TLS endpoints, so that they are better protected against store-now-decrypt-later attacks. The immediate goal is to configure support for at least X25519MLKEM768 on supported components and to understand the platform requirements.

Post-quantum key exchange in this context means hybrid key exchange algorithms for TLS 1.3. The minimum recommended target isX25519MLKEM768, with SecP256r1MLKEM768 and SecP384r1MLKEM1024 as desirable follow-up options.

Prerequisites

Post-quantum key exchange is applicable only in TLS 1.3. Make sure that you have enabled this protocol version in all desired endpoints.

Web interface - Management, End User Interface, YSoft Payment System

Support of the cipher suites and key exchange algorithms depends on the underlying TLS implementation. Apache Tomcat is able to use JSSEImplementation (Java) or OpenSSLImplementation (OpenSSL). While JSSEImplementation is currently the default, available version does not have support for post-quantum key exchange implemented. On the other hand, current version of the OpenSSLImplementation has post-quantum key exchange implemented and enabled by default. All you need to do is to configure Apache Tomcat to use it.

Instructions

  1. Locate and open the server.xml file. Standard locations are the following:

    1. Management interface: <install_dir>\Management\tomcat\conf\server.xml

    2. End User Interface: <install_dir>YPS\conf\server.xml

    3. YSoft Payment System: <install_dir>\SPOC\EUI\conf\server.xml

  2. Identify the relevant TLS Connector.

  3. Make sure the following attribute in this Connector key is configured to use OpenSSL implementation: sslImplementationName="org.apache.tomcat.util.net.openssl.OpenSSLImplementation"

  4. Convert your certificate to the OpenSSL-suitable form - for more information and examples, please refer to Configuring SSL/TLS for Dispatcher Paragon Management Service

  5. Restart the corresponding service.

Document upload and release - FlexiSpooler, Client v3, Job Service, Terminal Server, Mobile Integration Gateway

These components are dependent on the underlying operating system. Support for post-quantum key exchange was added to the Windows systems in July 2026, more specifically:

  • Windows Server 2025: KB5099536 (build 26100.33158)

  • Windows 11: KB5089573 for 24H2 and 25H2, KB5095091 for 26H1

However, in default operating system configuration the post-quantum key exchange algorithms are disabled.

Instructions

  1. Make sure you have the minimal required OS build

  2. Open PowerShell terminal as system administrator

  3. Use following PowerShell commands to enable desired post-quantum key exchange algorithms:

    > Enable-TlsEccCurve -Name "X25519_MLKEM768"
    > Enable-TlsEccCurve -Name "SecP256r1_MLKEM768"
    > Enable-TlsEccCurve -Name "SecP384r1_MLKEM1024"

    1. Optionally you can move these algorithms to the top of the ordered priority list:

      > Enable-TlsEccCurve -Name "X25519_MLKEM768" -Position 0

  4. Verify that the OS accepted your configuration:

    > Get-TlsEccCurve

  5. [Optional] Restart the corresponding service - the support should work right away after the algorithms are enabled in the system, but it may happen that the modification does not take effect without service restart. If you checked the support and post-quantum key exchange algorithms are not supported, you may try to restart the service.