Is your domain quantum-safe on the wire?
Enter a hostname. The AERE Cloud host opens real TLS connections to it and tells you, measured, whether it already negotiates hybrid post-quantum key exchange (X25519 + ML-KEM-768), whether recorded traffic is exposed to harvest-now-decrypt-later, what its certificate is, and what to change first.
What this measures, and what it does not. Five real connections to port 443 of the hostname from our EU host: a classical TLS 1.3 baseline, a TLS 1.3 handshake offering only the hybrid post-quantum group, one offering it first with classical fallbacks (to see preference), a TLS 1.2-only handshake, and an HTTPS HEAD for HSTS. It reads the served certificate chain. Every public certificate today is classical (ECDSA or RSA): that is reported, not penalised, because no certificate authority issues post-quantum certificates yet. It does not measure your applications, keys at rest, internal services, VPNs or source code; a full quantum readiness assessment covers those. Results are cached for six hours; scans are limited per client. The API is POST https://cloud.aere.network/v1/pq/readiness with {"domain": "..."}, free, no key. Attested reports. With an Aere Cloud key, add "attest": true: the SHA-256 digest of the measured report is written to chain 2800 and covered by the validators’ post-quantum certificate at the next anchor, so the report carries a first-seen time that cannot be backdated or rewritten; GET /v1/proof/{reportHash} returns the covering anchor and how to verify it without us. See the API docs.