← Knowledge base

CDNs and hosted websites

A static website or single-page application inherits transport security from the service terminating HTTPS. Application JavaScript cannot enable a TLS named group on the hosting provider.

Evidence to collect

1. Identify the actual TLS termination service for each custom domain, including Akamai, Fastly, Vercel, or Netlify deployments.
2. Check the public custom domain rather than assuming the provider’s own website has the same configuration.
3. Inventory browser-to-CDN, CDN-to-origin, and application API connections separately.
4. If the provider does not document or expose the selected group, retain unknown for that hop.

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

• TLS 1.3 protocol and key exchange

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.