← Knowledge base

Caddy

Caddy uses Go TLS. Go 1.24 introduced standardized X25519MLKEM768 support; the older Go 1.23 hybrid used a draft Kyber group. The Go toolchain used to build Caddy matters.

Evidence to collect

  1. Record the deployed Caddy build, including its Go toolchain.
  2. Review the Caddy tls directive and any explicit curves setting rather than assuming defaults are unchanged.
  3. Verify the selected group at the public hostname; test origins separately when Caddy sits behind a CDN.

Read-only inventory

Run this in the environment used by the application. Missing commands mean the tool is unavailable. This output is inventory, not a negotiation result.

caddy version
caddy build-info

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.