TLS posture of every public host.

1. Classical-only handshake (OpenSSL)

openssl s_client -connect qtonicquantum.com:443 -servername qtonicquantum.com -groups X25519:P-256 -brief </dev/null

• Handshake completes (protocol and cipher lines print): the host accepts classical-only clients. Expected under “post-quantum preferred; classical fallback accepted” and “post-quantum and classical both accepted”.
• Handshake fails with an alert (for example alert handshake failure): the host refuses classical-only clients. Expected under “post-quantum only”.

2. Post-quantum-only handshake (Node 22.20 or newer)

ML-KEM TLS groups ship from OpenSSL 3.5; Node 22.20 and newer bundle it. Check first: node -p process.versions.openssl should print 3.5 or newer.

node -e "const tls = require('node:tls'); const host = process.argv[1]; const socket = tls.connect({ host, port: 443, servername: host, ecdhCurve: 'X25519MLKEM768' }, () => { console.log('accepted', socket.getProtocol()); socket.end(); }); socket.on('error', (error) => { console.log('rejected', error.code || error.message); process.exitCode = 1; });" qtonicquantum.com

• Prints accepted TLSv1.3: the host negotiates the X25519MLKEM768 hybrid group. Expected on every host with an enforced posture.
• Prints rejected and a code: the host did not complete a post-quantum-only handshake. Under an enforced posture that is the breach the monitor alerts on; under “advisory” it is a note.
• Node exits before connecting with an error about the group: your client cannot offer ML-KEM. That describes your OpenSSL, not the host.