refactor(certinfo): test http server

.github/workflows/codeChecks.yml

@@ -26,7 +26,7 @@ jobs:
     strategy:
       max-parallel: 2
       matrix:
-        go-version: ["1.27.0"]
+        go-version: ["1.27.1"]
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -47,7 +47,7 @@ jobs:
     strategy:
       max-parallel: 2
       matrix:
-        go-version: ["1.27.0"]
+        go-version: ["1.27.1"]
 
     steps:
       - name: Checkout
@@ -74,7 +74,7 @@ jobs:
     strategy:
       max-parallel: 2
       matrix:
-        go-version: ["1.27.0"]
+        go-version: ["1.27.1"]
 
     steps:
       - name: Checkout
@@ -103,7 +103,7 @@ jobs:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.27.0"
+          go-version: "1.27.1"
 
       - name: generate test coverage
         run: go test ./... -coverprofile=./cover.out -covermode=atomic -coverpkg=./...

.github/workflows/release.yml

@@ -12,7 +12,7 @@ permissions:
 env:
   CGO_ENABLED: 0
   DOCKER_CLI_EXPERIMENTAL: "enabled"
-  GO_VERSION: "1.27.0"
+  GO_VERSION: "1.27.1"
 
 jobs:
   code-checks:

CHANGELOG.md

@@ -1,5 +1,17 @@
+<!-- markdownlint-disable MD024 -->
+
 # https-wrench - changelog
 
+## Unreleased
+
+### CI
+
+    switch to Go 1.27.1
+
+### Tests
+
+    Certinfo: GetRemoteCerts tests apply SetTLSInsecure before SetTLSEndpoint so endpoint certificate retrieval uses the intended TLS verification mode.
+
 ## 0.15.1 (2026-09-03)
 
 ### Feat

go.mod

@@ -1,6 +1,6 @@
 module github.com/xenos76/https-wrench
 
-go 1.27.0
+go 1.27.1
 
 require (
 	github.com/MicahParks/jwkset v0.11.3

internal/certinfo/certinfo_handlers.go

@@ -26,6 +26,17 @@ import (
 	"github.com/xenos76/https-wrench/internal/style"
 )
 
+// defaultCurvePreferences lists Go 1.27 TLS hybrids plus classical fallbacks.
+// Explicit CurvePreferences keeps PQ on when GODEBUG=tlsmlkem=0 / tlssecpmlkem=0.
+var defaultCurvePreferences = []tls.CurveID{
+	tls.X25519MLKEM768,
+	tls.SecP256r1MLKEM768,
+	tls.SecP384r1MLKEM1024,
+	tls.X25519,
+	tls.CurveP256,
+	tls.CurveP384,
+}
+
 // PrintData prints all collected certificate and key information (local files and remote endpoints)
 // to the provided writer in a human-readable format.
 //
@@ -202,6 +213,7 @@ func (c *Config) GetRemoteCerts(ctx context.Context) error {
 	tlsConfig := &tls.Config{
 		RootCAs:            c.CACertsPool,
 		InsecureSkipVerify: c.TLSInsecure,
+		CurvePreferences:   slices.Clone(defaultCurvePreferences),
 	}
 
 	verifyName := c.TLSServerName