Cryptographic Posture Management — discover, grade & remediate your whole cryptographic estate
Sovereign Certificate Authority for enterprise-grade certificate issuance & management
Certificate Lifecycle Management, discovery, governance & automation
DNS-agnostic Domain Control Validation, ready for 47-day TLS certificates
Post-quantum migration is no longer a research topic: regulators have published the dates and attackers are already harvesting encrypted traffic. This guide frames the two clocks driving PQC urgency — the threat clock and the regulatory clock — and walks the proven three-phase playbook (Inventory, Remediation, Crypto-agility) for migrating a certificate estate without an outage.
Post-quantum cryptography (PQC) is the set of classical algorithms — running on classical computers — whose security does not collapse in front of a cryptographically relevant quantum computer. The migration to PQC is not a distant research problem: the NIST standards are published (ML-KEM, ML-DSA, SLH-DSA), regulators have set dated milestones, and "harvest now, decrypt later" attacks make any long-lived confidential data a present-day exposure.
The practical question for a security team is rarely "which algorithm?" and almost always "where is my cryptography, and how fast can I change it?" This guide answers both by separating the two clocks that create the urgency and laying out the three-phase playbook — Inventory, Remediation, Crypto-agility — that turns a multi-year migration into a governed program rather than a fire drill.
Post-quantum migration has quietly crossed the line from conference-slide topic to dated obligation. Two things happened at once: NIST finalised the first post-quantum standards, and regulators across Europe and the United States attached calendar years to the transition. In the middle sits a security team that, in most organisations, cannot yet answer the one question both developments demand — where is our cryptography, and how quickly can we change it?
This guide is about answering that question. It separates the two independent clocks that make PQC urgent, then walks the three-phase playbook — inventory, remediation, crypto-agility — that migrates a certificate estate in the right order, without an outage, and leaves the next migration easier than this one.
The pressure to migrate does not come from a single deadline. It comes from two clocks running in parallel, each answering a different "why now?", and most organisations can read neither with confidence.
Both clocks ask the same first question, and it is not "which algorithm should we pick?" It is "where is our cryptography, and how fast can we change it?" That is why the migration is a program with a fixed order of operations, not a product you install.
All of today's PKI rests on two hard maths problems: RSA factoring and elliptic-curve discrete log. A large enough quantum computer breaks both. Attackers do not need that computer yet — they store your encrypted traffic now and decrypt it once the hardware catches up. Any data that must stay confidential past 2030 is already at risk, and forged signatures (trust-now-forge-later) follow the moment a cryptographically relevant quantum computer exists.
DORA, NIS2, the Cyber Resilience Act and eIDAS 2.0 already embed a crypto-agility requirement. The EU PQC roadmap sets three milestones: a national migration plan by 31 December 2026, high-risk use cases migrated by 2030, full migration by 2035. ANSSI expects hybrid post-quantum mechanisms for security-product qualification from 2027 and considers non-PQC acquisitions unreasonable from 2030; Germany's BSI phases out classical key exchange by 2031 and classical signatures by 2035; the US targets 2035 under CNSA 2.0.
Post-quantum migration runs in three phases, always in this order. Skipping inventory means remediating blind; treating remediation as the finish line means repeating the whole exercise for the next algorithm. The third phase is what makes the first two pay off.
The order matters because each phase de-risks the next. A scored inventory tells you what to remediate first (long-lived, high-value, past-deadline certificates); hybrid issuance lets you remediate without a flag-day cutover; and a crypto-agile architecture means the FN-DSA or HQC migration after this one is a configuration change, not another multi-year program.
Discover certificates everywhere they live: network TLS scans, local file and keystore scans, imports from nmap, Qualys, Nessus and Tenable, or Infrastructure-as-Code feeds. Grade every discovered certificate on ingest — non-hybrid certificates expiring after the 2030/2035 deadlines are penalised, hybrid post-quantum certificates earn bonuses. The result is a live, scored inventory of quantum-vulnerable certificates, not a one-off audit spreadsheet.
Issue hybrid certificates that carry classical and post-quantum keys in a single object, so legacy and upgraded clients keep working through the transition. Run a post-quantum CA in parallel with your existing chain and replace certificates progressively, population by population, through the enrollment protocols you already use — ACME, EST, SCEP, CMP and REST. Anchor keys in post-quantum-ready HSMs.
Treat the platform as a consumer of cryptography, not a hard-coded implementation: when a new algorithm is standardised and shipped by providers, it appears in the tool. Migrating a certificate population to a new algorithm or format becomes a profile change, not a redeployment project. PQC is the first migration this architecture absorbs — it will not be the last.
"Post-quantum ready" is easy to put on a slide and hard to put in production. Concretely, a ready platform ships the standardised algorithms and every certificate format the transition needs today, not at some future ratification date.
ML-KEM, ML-DSA and SLH-DSA — the NIST standards published as FIPS 203, 204 and 205 — running in production now. FN-DSA and HQC follow at ratification.
Catalyst hybrid certificates, pure PQC certificates, and linked dual certificates are all covered; composite certificates land at IETF ratification. Both the European hybrid recommendation and the US pure-PQC track are supported.
Ship what NIST, IETF and ISO ratify — no proprietary algorithm bets, no format lock-in. The inventory grades against ANSSI and CA/Browser Forum policies so "ready" is measured, not asserted.
Certificates are where post-quantum migration starts, because they are the most visible, most numerous, and most deadline-bound piece of an organisation's cryptography. They are not where it ends: keys in application code, algorithms baked into protocols, and cryptographic libraries across the estate all have to migrate too. The discipline that covers the full picture is crypto-agility — the ability to see every use of cryptography, change any one of them on demand, and prove it to an auditor.
Getting the certificate estate under a live, graded inventory and a hybrid-capable CA is the fastest, highest-leverage first move: it retires the nearest deadlines, produces the compliance evidence regulators are about to ask for, and stands up the crypto-agile machinery that every later migration will reuse.
The migration is a multi-year program, but the first step is small and immediate: get a scored read on your post-quantum exposure, and pick the first population to remediate.
