JA EN
shiichan

Radar's Post-Quantum Checker Now Names Your TLS Bugs!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#web

Hey everyone, it's me, Shii-chan! Today I've got a little treat for the security nerds among us. TLS testing for the post-quantum era just got a bit smarter.

Cloudflare Changelog developers.cloudflare.com

What was announced?

From Cloudflare's Changelog, the Radar post-quantum TLS support checker got an update. It used to just tell you whether a host supports post-quantum key exchange, but now it also reports TLS bugs it finds during the handshake test. The "bugs" section only shows up for hosts where issues are found, and it comes with details on each bug plus guidance on how to investigate and fix it.

The story so far

Before this, the checker could tell you "supported" or "not supported," but not exactly why a handshake was going wrong. Post-quantum keys are large, so the ClientHello often gets fragmented, and something in the middle can quietly break the connection — which made root-causing surprisingly annoying.

What changes

Now the checker names the culprit for you. Three bugs are detected:

  • Split ClientHello — The connection fails with a fragmented post-quantum ClientHello but succeeds with classical handshakes. Usually caused by middleboxes or firewalls that cannot reassemble split TLS messages.
  • HRR Failure — The server sends a HelloRetryRequest but fails to complete the handshake afterward.
  • Unknown Keyshare — The server cannot handle unknown key exchange algorithms and fails instead of responding with a HelloRetryRequest as required by the TLS 1.3 specification.

Once you know the cause, it's much easier to see whether the fix belongs in your firewall config or your server implementation.

Dive Deep

This bug detection data isn't behind a new API — you can pull it straight from the existing /post_quantum/tls/support endpoint, which is handy if you want to wire it into automated checks. For a quick manual test, head to the Post-Quantum Encryption page and enter a hostname.

Wrap-up

  • Radar's post-quantum TLS checker now shows detected TLS bugs along with remediation guidance
  • The three detected bugs are Split ClientHello, HRR Failure, and Unknown Keyshare
  • The data is also available from the existing /post_quantum/tls/support endpoint

If you're planning a post-quantum migration and wondering "is my site actually completing its handshakes?", this one's for you, infra and security folks!

Related posts