Find out why your server isn't post-quantum, and fix it
Flarebox and pqdoctor: tools that check whether your servers negotiate post-quantum TLS, explain why not, and print the config fix. One Rust engine behind a CLI, a desktop app for Cloudflare, a GitHub Action and a web checker.
Most browser traffic to Cloudflare is already post-quantum, but the origin servers behind it mostly aren't. I wanted to know why, so I built pqdoctor: it sends hand-built TLS hellos, works out the exact cause (old OpenSSL, a pinned curve list, a middlebox dropping big hellos) and prints the config line that fixes it. Flarebox grew around it as a desktop app for running Cloudflare accounts. I've since used it to measure PQ adoption across a sample of the Tranco top 1M: about 22% of self-run origins negotiate hybrid ML-KEM. Built by one person, Kalyan Gopalam.
Our stack
One Rust engine (the pqdoctor crate), compiled to WebAssembly for the web checker on Cloudflare Workers. Flarebox is Tauri 2 with a React + TypeScript UI. Fleet runs on Workers + D1. Shipped through crates.io, Homebrew, Scoop and a GitHub Action. Results cross-checked against OpenSSL 3.5 and Go crypto/tls.