# Configure hybrid post-quantum TLS
<a name="pqtls-how-to"></a>

In this procedure, add a Maven dependency for the Amazon Common Runtime HTTP Client. Next, configure an HTTP client that prefers post-quantum TLS. Then, create an Amazon KMS client that uses the HTTP client.

To see a complete working example of configuring and using hybrid post-quantum TLS with Amazon KMS, see the [aws-kms-pq-tls-example](https://github.com/aws-samples/aws-kms-pq-tls-example) repository on GitHub.

1. Add the Amazon Common Runtime client to your Maven dependencies. We recommend using the latest available version. 

   For example, this statement adds version `2.30.22` of the Amazon Common Runtime client to your Maven dependencies. Use version `2.30.22` or later to enable ML-KEM. 

   ```
   <dependency>
       <groupId>software.amazon.awssdk</groupId>
       <artifactId>aws-crt-client</artifactId>
       <version>2.30.22</version>
   </dependency>
   ```

1. To enable the hybrid post-quantum cipher suites, add the Amazon SDK for Java 2.x to your project and initialize it. Then enable the hybrid post-quantum cipher suites on your HTTP client as shown in the following example.

   This code uses the `postQuantumTlsEnabled()` method parameter to configure an [Amazon common runtime HTTP client](https://docs.amazonaws.cn/sdk-for-java/latest/developer-guide/http-configuration-crt.html) that prefers the recommended hybrid post-quantum cipher suite, ECDH with ML-KEM. Then it uses the configured HTTP client to build an instance of the Amazon KMS asynchronous client, [`KmsAsyncClient`](https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/kms/KmsAsyncClient.html). After this code completes, all [Amazon KMS API](https://docs.amazonaws.cn/kms/latest/APIReference/) requests on the `KmsAsyncClient` instance use hybrid post-quantum TLS.

   ```
   // Configure HTTP client
   SdkAsyncHttpClient awsCrtHttpClient = AwsCrtAsyncHttpClient.builder()
             .postQuantumTlsEnabled(true)
             .build();
   
   // Create the Amazon KMS async client
   KmsAsyncClient kmsAsync = KmsAsyncClient.builder()
            .httpClient(awsCrtHttpClient)
            .build();
   ```

1. Test your Amazon KMS calls with hybrid post-quantum TLS.

   When you call Amazon KMS API operations on the configured Amazon KMS client, your calls are transmitted to the Amazon KMS endpoint using hybrid post-quantum TLS. To test your configuration, call an Amazon KMS API, such as `[ListKeys](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListKeys.html)`.

   ```
   ListKeysReponse keys = kmsAsync.listKeys().get();
   ```

   To confirm that your call used hybrid post-quantum TLS, inspect its CloudTrail log entry as described in [Verifying and Monitoring Hybrid Post-Quantum TLS](pqtls.md#pqtls-verify).