Legacy → PQC

Make a classical-only client's connection quantum-safe without touching it.

client offers classical only (X25519/P-256/RSA) → TLS Lane → PQC-capable server

When you need it: A client that can't speak PQC — an old library, curl, an IoT device, a microservice — reaching a PQC-capable origin. You want the connection quantum-safe even though the client can't ask. The harvest-now-decrypt-later defense for endpoints you can't upgrade.
How it works: TLS Lane injects the hybrid group (X25519MLKEM768) into the upstream-bound ClientHello, so the outbound leg negotiates post-quantum while the client leg stays classical.
Good to know: The server must support the hybrid group. This is the headline adapter.
TLS version: TLS 1.3 outbound

Enable sudo tlslane splice