AC1: the TLS key exchange groups Secp256r1MLKEM768 and Secp384r1MLKEM1024 are supported and working in FIPS:PQ policy AC2: The group X25519MLKEM768 is not supported in FIPS:PQ policy and cannot be negotiated (client doesn't negotiate it, server will not select it) AC3: the implementation of Secp256r1 and Secp384r1 is fetched from the fips.so provider when in FIPS mode AC4: when system is in FIPS mode and running the FIPS:PQ policy, the openssl client sends Secp256r1MLKEM768 and SECP256r1 key shares by default (see also RHEL-91292 ) AC5: when in FIPS mode and running FIPS policy, the post-quantum groups are not advertised

Feature, enhancement: Hybrid Post-Quantum groups are now supported in FIPS mode Reason: The new version of the OpenSSL package has been updated to fetch the ECDH part of the new hybrid post-quantum groups from the fips.so provider when the system is running in FIPS mode. Result: The OpenSSL library is using FIPS certified cryptography for the ECDH part of the hybrid post-quantum key exchanges. When the system is running with the ``FIPS:PQ`` crypto-policy, the hybrid post-quantum groups are enabled and used by default by openssl servers and clients.