# Ssl-default-server-curves completely ignored

**URL:** https://discourse.haproxy.org/t/ssl-default-server-curves-completely-ignored/12703
**Category:** Help!
**Created:** [September 25, 2026, 6:49pm UTC](https://discourse.haproxy.org/t/ssl-default-server-curves-completely-ignored/12703 "2026-09-25T18:49:07Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![apollo13](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/apollo13/32/2614_2.png) [@apollo13](https://discourse.haproxy.org/u/apollo13)
#### Post date: [September 25, 2026, 6:49pm UTC](https://discourse.haproxy.org/t/ssl-default-server-curves-completely-ignored/12703/1 "2026-09-25T18:49:07Z")

</div>

Hi there,

I am sure I am doing something horribly wrong, but I just cannot find out what. I am trying to disable X25519MLKEM768 key exchanges for the backend connections to reduce the overhead of the connection. As such I am running with the following configuration on haproxy docker images `haproxytech/haproxy:debian-3.4.5` as well as `haproxy:3.4.5`:

```auto
global
    ssl-default-server-curves secp384r1
    ssl-default-server-options ssl-min-ver TLSv1.3 no-tls-tickets
    
defaults
    mode http
    log global
    option httplog
    option dontlognull
    timeout client 1s
    timeout connect 1s
    timeout server 1s

frontend main
    bind *:8080
    default_backend app
    
frontend test
    bind *:4040
    http-request return status 200 content-type text/plain string OK\n

backend app
    default-server ssl verify none no-sni-auto no-check-sni-auto curves secp384r1
    server test1 127.0.0.1:4040

```

`ssl-default-server-curves secp384r1` is used on purpose for demonstration purposes. Now when connecting via HTTP to port 8080 haproxy tries to make a SSL connection to port 4040. It obviously fails because the backend is not SSL aware but the important part is in the “Client Hello” TLS message that haproxy sends:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/c/cb59e25ce40d18d9c7304f5f5d197da6743bfcaf.png)

As you can see the key\_share still uses X25519MLKEM768. No matter what I try, I cannot get haproxy to send a non pqc aware key exchange.

Any ideas what I am doing wrong?

Thanks,  
Florian

---

<div class="post-metadata">

### Author: ![apollo13](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/apollo13/32/2614_2.png) [@apollo13](https://discourse.haproxy.org/u/apollo13)
#### Post date: [September 25, 2026, 7:11pm UTC](https://discourse.haproxy.org/t/ssl-default-server-curves-completely-ignored/12703/2 "2026-09-25T19:11:44Z")

</div>

Uff, it seems to work if I put `curves …` on the server line, but not when used in default-server or the global options. Sounds like a bug?