Diagnostic Case Study: Client-Side and Ecosystem Barriers in Integrating Post-Quantum Cryptography Kyber768 Into TLS 1.3

The advancement of quantum computing poses a significant threat to widely deployed public-key cryptographic algorithms. In response, post-quantum cryptography (PQC) integration within Transport Layer Security (TLS) 1.3 is recommended as a transitional strategy. This paper presents a diagnostic case study analyzing the real-world deployment barriers of integrating the CRYSTALS-Kyber768 key encapsulation mechanism into TLS 1.3. An experimental cloud-based server was explicitly configured using OpenSSL 3.2.3 and the Open Quantum Safe (OQS) Provider to support a hybrid X25519+Kyber768 key exchange. However, empirical observations revealed that the negotiated TLS handshake consistently fell back to classical elliptic-curve cryptography (X25519). Through detailed diagnostic analysis, this study identifies two primary ecosystem barriers: the lack of client-side capability to advertise Kyber-supported groups in the ClientHello message, and intermediary infrastructure (e.g., CDNs) terminating connections with classical ECDSA certificates. Rather than presenting a failed deployment, this research highlights critical gaps between PQC standardization and practical adoption, emphasizing that server-side readiness is insufficient without a synchronized, end-to-end ecosystem upgrade.