I tried post-quantum key exchange with Amazon Corretto 27, which became GA

FROM debian:trixie-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    openssl \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /certs

# Generate a self-signed server certificate (no CA, single certificate)
RUN openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
    -keyout server.key -out server.crt -days 1 -nodes \
    -subj "/CN=tls-server" \
    -addext "subjectAltName=DNS:tls-server,IP:127.0.0.1"

EXPOSE 4433

# -trace: outputs handshake details (including named group) to stderr
CMD ["openssl", "s_server", \
     "-key", "/certs/server.key", \
     "-cert", "/certs/server.crt", \
     "-accept", "4433", \
     "-tls1_3", \
     "-trace", \
     "-www"]

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Corretto 27 - automatic architecture detection
ARG TARGETARCH
RUN case "${TARGETARCH}" in \
      amd64) JDK_URL="https://corretto.aws/downloads/latest/amazon-corretto-27-x64-linux-jdk.tar.gz" ;; \
      arm64) JDK_URL="https://corretto.aws/downloads/latest/amazon-corretto-27-aarch64-linux-jdk.tar.gz" ;; \
      *) echo "Unsupported arch: ${TARGETARCH}" && exit 1 ;; \
    esac \
    && curl -fsSL "${JDK_URL}" | tar -xz -C /opt \
    && ln -s /opt/amazon-corretto-27* /opt/java

ENV JAVA_HOME=/opt/java
ENV PATH="${JAVA_HOME}/bin:${PATH}"

WORKDIR /app

COPY PqTlsCheck.java .
RUN javac PqTlsCheck.java

# -Djavax.net.debug=ssl:handshake outputs full handshake log
# Server certificate validation is disabled (due to self-signed certificate)
CMD ["java", \
     "-Djavax.net.debug=ssl:handshake", \
     "-Dcom.sun.jndi.ldap.object.trustURLCodebase=false", \
     "PqTlsCheck", "tls-server", "4433"]

import javax.net.ssl.*;
import java.io.*;
import java.security.cert.X509Certificate;

/**
 * Corretto 27 PQ TLS handshake verification tool.
 * Performs TLS 1.3 negotiation with the target server and
 * logs the selected cipher suite / named group.
 *
 * Uses a TrustManager with certificate validation disabled (for self-signed certificates).
 * In production, do not use this TrustManager; instead, enable the JDK default TrustManager
 * (with certificate validation) and hostname verification.
 */
public class PqTlsCheck {

    public static void main(String[] args) throws Exception {
        String host = args.length > 0 ? args[0] : "localhost";
        int port    = args.length > 1 ? Integer.parseInt(args[1]) : 4433;

        System.out.println("=== Corretto 27 PQ TLS Check ===");
        System.out.println("Target: " + host + ":" + port);
        System.out.println("Java version: " + System.getProperty("java.version"));
        System.out.println("Java vendor:  " + System.getProperty("java.vendor"));
        System.out.println();

        // TrustManager that accepts self-signed certificates (for verification use only)
        TrustManager[] trustAll = new TrustManager[]{
            new X509TrustManager() {
                public void checkClientTrusted(X509Certificate[] c, String a) {}
                public void checkServerTrusted(X509Certificate[] c, String a) {}
                public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
            }
        };

        SSLContext ctx = SSLContext.getInstance("TLS");
        ctx.init(null, trustAll, null);

        SSLSocketFactory factory = ctx.getSocketFactory();
        try (SSLSocket socket = (SSLSocket) factory.createSocket(host, port)) {
            socket.setEnabledProtocols(new String[]{"TLSv1.3"});

            // Returns null since no explicit setting is made (JDK default applies)
            SSLParameters params = socket.getSSLParameters();
            String[] namedGroups = params.getNamedGroups();
            System.out.println("--- Named Groups (client preference order) ---");
            if (namedGroups != null) {
                for (int i = 0; i < namedGroups.length; i++) {
                    System.out.printf("  [%d] %s%n", i, namedGroups[i]);
                }
            } else {
                System.out.println("  (not set explicitly — JDK default applies)");
            }
            System.out.println();

            // Execute handshake (ssl:handshake debug log is output by JVM)
            socket.startHandshake();

            SSLSession session = socket.getSession();
            System.out.println("--- TLS Session ---");
            System.out.println("Protocol:     " + session.getProtocol());
            System.out.println("CipherSuite:  " + session.getCipherSuite());
            System.out.println("PeerHost:     " + session.getPeerHost());
            System.out.println();
            System.out.println("SUCCESS: TLS handshake completed.");
        }
    }
}