Post-quantum VPN
Post-Quantum OpenVPN Compatibility: Clients, Libraries and Platforms
Quick answer
Compatibility depends on the complete combination of client, OpenVPN binary, loaded cryptographic library, profile and server policy. The required current-release group is SecP384r1MLKEM1024. A supported operating system or an OpenVPN version number alone does not prove that a particular installation can negotiate it.
Platform availability and verification status
The current product information lists Windows, Linux and macOS support, with Android beta planned. Use official Downloads to check which package and architecture are currently available. The table distinguishes product availability from a published reproducible negotiation result; it is not a certification matrix.
| Platform | Product status | What to check before relying on the group |
|---|---|---|
| Windows | Listed as supported; an installation guide is available. | Official package, selected openvpn.exe, loaded library and successful-session group. |
| Linux | Listed as supported; check current Downloads. | Package architecture, selected binary, linked library/provider and successful-session group. |
| macOS | Listed as supported; check current Downloads. | Package architecture, selected binary, library/provider and successful-session group. |
| Android | Beta planned in current product information. | Confirm release availability and the exact protocol before assuming support. |
The measured connection-log case study records three successful route-isolated connections on Windows with OpenVPN 2.7.0 and OpenSSL 3.6.1. It verifies the selected group in that configuration, with no TUN/TAP traffic. It does not establish routed operation or results for other platforms. Do not read the availability column as a claim that every package or third-party client has passed a specific test.
Check four dependencies together
- Client and executable: identify the actual binary the application launches. An old binary elsewhere on the device can differ from the one you just installed.
- Cryptographic library: record the version and provider loaded by that binary. A separate system OpenSSL installation may not be used by the VPN.
- Profile and policy: use the issued profile and intended TLS group settings. Do not loosen the list to work around an unsupported group.
- Server and session: confirm the server accepts the policy and the completed handshake selects the expected group.
OpenSSL's ML-KEM documentation is useful for understanding library capability, but library capability is still only one part of this chain.
Prepare an evidence record
| Field | Record |
|---|---|
| Device | OS release and CPU architecture. |
| Software | ALightVPN package identifier, OpenVPN version, library and provider. |
| Policy | Profile issue date, effective minimum TLS version and allowed groups; omit private profile material. |
| Result | Connection time, successful/failed status, selected group and sanitized diagnostic excerpt. |
Recheck after changing any dependency. A result for one architecture or package should not be silently extended to another.
When the group is unavailable
Return to the supported download path and ask for the correct dependency combination. Keep certificate checks enabled. An error can reflect a missing group, a library/provider mismatch, certificate validation or an unrelated connection issue.
Begin with Windows setup where applicable, then verify the session. For other platforms, use the current package instructions or contact support rather than adapting a different protocol's configuration. StrongSwan/IPsec and OpenVPN claims require separate evidence.
Common questions
Can any OpenVPN client use the current group?
Do not assume so. The exact binary, library/provider, profile and server must support and negotiate the group together.
Does updating system OpenSSL update my VPN's library?
Not necessarily. A client may load a bundled or differently linked library. Check the actual executable's reported dependencies.
Is Android support established by this table?
No. The current product information describes a planned beta. Check release availability and protocol-specific evidence before relying on it.
Sources and product references
- OpenVPN 2.7 manual: groups, TLS and diagnostics
- OpenSSL 3.5: ML-KEM implementation reference
- Official ALightVPN downloads
Reviewed 2 November 2026. Release configuration and platform availability are distinct from live-session test evidence.