PQC toolkit setup guide

This guide is for the PQC toolkit. For instructions on setting up the DigiCert PQC dockerized toolkit, see PQC dockerized toolkit guide.

Introduction

DigiCert's post-quantum cryptographic (PQC) toolkit contains everything needed to create a hybrid TLS certificate. This hybrid certificate uses a post-quantum cryptographic algorithm paired with a classical cryptographic algorithm, allowing you to test the viability of deploying post-quantum hybrid TLS certificates while also maintaining backwards compatibility.

For this first iteration, the post-quantum cryptographic algorithm is paired with an elliptical curve cryptographic algorithm.

This setup guide walks you through using the DigiCert PQC toolkit to:

Apply the ISARA PQC Patch to OpenSSL source files.
Compile your modified OpenSSL program.
Generate post-quantum cryptographic keys.
Create a complete hybrid certificate chain, including root, intermediate, and server certificates.
Test the certificates using OpenSSL's s_server and s_client utilities.

DigiCert PQC toolkit is available to download for all Secure Site Pro customers. Learn more about what's included with each Secure Site Pro certificate.

PQC toolkit contents

DigiCert PQC toolkit contains these files:

ISARA Catalyst OpenSSL Connector
Modified openssl.cnf
Certificate configuration files
Example hybrid certificate chain

Prerequisites

Before using this guide, make sure these prerequisites are met:

Access to the DigiCert PQC toolkit resource files
64-bit Ubuntu 16.04 or later (this guide was written using Ubuntu 18.04 LTS)
Non-root user with sudo access

To protect your system or production environment from issues, we recommend you follow these steps using a sandbox or virtual environment.

Prepare your environment

Before downloading and patching files, prepare your environment.

First, install the necessary dependencies and tools.

bash

sudo apt-get -y update
sudo apt-get -y upgrade
sudo apt-get -y install curl unzip make cmake gcc wget zlib1g-dev libjansson-dev

Next, create the directory structure where you'll download and compile source files and toolkit resources.

bash

mkdir -p /app/digicert-pqc/connector
mkdir -p /app/digicert-pqc/certs/configs
mkdir /app/resources

Download and extract toolkit

Now, download the DigiCert PQC toolkit and extract its contents.

Download PQC toolkit

Sign in to your CertCentral account.
In the sidebar menu, click Certificates > Orders.
On the Orders page, locate your Secure Site Pro certificate order and click its order number.
On the certificate's order details page, click PQC toolkit.
On the Post-quantum cryptography (PQC) page, click Download the ISARA PQC toolkit and save the toolkit to the /app/resources directory.

Extract PQC toolkit files

Next, extract the contents from the toolkit.

bash

cd /app/resources
unzip ./DigiCert_PQC_Toolkit.zip

The PQC toolkit contains the ISARA OpenSSL Connector archive. Extract this to /app/digicert-pqc/connector.

bash

cd /app/digicert-pqc/connector
tar xzvf /app/resources/digicert-pqc-toolkit_2019-07-26/openssl_connector-Linux-2019-05-27.tgz

Patch and compile OpenSSL

After you've set up the environment and extracted all the files, patch and compile OpenSSL.

To start, download OpenSSL version 1.0.2r to the /app/resources directory.

bash

cd /app/resources
wget https://www.openssl.org/source/old/1.0.2/openssl-1.0.2r.tar.gz

Next, extract the source files to the /app/digicert-pqc directory.

bash

cd /app/digicert-pqc
tar xzvf /app/resources/openssl-1.0.2r.tar.gz

Now, apply the ISARA OpenSSL patch to the extracted source files. This makes all the necessary modifications for OpenSSL to generate and interpret quantum-safe cryptographic algorithms.

bash

cd openssl-1.0.2r/
patch -p2 < ../connector/OpenSSL_1_0_2r_ISARA.patch

After the patch finishes, replace the existing openssl.cnf file with the modified version from the toolkit. This modified config file contains a dynamic engine entry that points to the ISARA OpenSSL IQREngine.

bash

cp /app/resources/digicert-pqc-toolkit_2019-07-26/openssl.cnf ./apps

Now you need to edit the modified config file so that it points to the location of the ISARA OpenSSL IQREngine.

Open the copied openssl.cnf file in your preferred text editor.

bash

vi ./apps/openssl.cnf

Locate the dynamic_path entry on line 32.
Change the entry to this:

bash

dynamic_path = /app/digicert-pqc/connector/lib/libiqre_engine.so

Save and close the file.

Because you're creating a shared OpenSSL library, you'll need to configure the non-standard paths before compiling the source files.

bash

./config --prefix=/app/digicert-pqc/pqpki-openssl-1.0.2r --openssldir=/app/digicert-pqc/pqpki-openssl-1.0.2r shared

Now, execute each of the commands below, one at a time, to compile the modified source files.

bash

make depend
make all
sudo make install

After successfully compiling the modified OpenSSL source, use the LD_LIBRARY_PATH variable to specify two dynamic library locations. This tells your system where to find both your modified OpenSSL shared libraries as well as the ISARA PQC engine used to handle quantum-safe cryptographic algorithms.

bash

export LD_LIBRARY_PATH=/app/digicert-pqc/pqpki-openssl-1.0.2r:/app/digicert-pqc/connector/lib

If your system already uses the LD_LIBRARY_PATH variable, you can append :$LD_LIBRARY_PATH to the above command to non-destructively add the new paths.

Create a hybrid certificate chain

Now, you have an OpenSSL program capable of generating and decoding quantum-safe cryptographic algorithms. You're ready to create a complete hybrid certificate chain (root, intermediate, and server certificates) so you can test its functionality.

First, copy the certificate configuration files that were included in the PQC toolkit to the /app/digicert-pqc/certs directory. These configuration files contain all the information necessary to generate each certificate request and certificate.

bash

cd /app/digicert-pqc/certs
cp /app/resources/digicert-pqc-toolkit_2019-07-26/certificates/root_req.cfg ./configs
cp /app/resources/digicert-pqc-toolkit_2019-07-26/certificates/intermediate_req.cfg ./configs
cp /app/resources/digicert-pqc-toolkit_2019-07-26/certificates/server_req.cfg ./configs

Generate private and public keys

Next, generate quantum-safe private keys for each certificate in the chain, making sure to use the modified OpenSSL program as well as the IQREngine.

Root private key:

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl genpkey -engine IQREngine -algorithm xmss -pkeyopt tree_height:10 -pkeyopt strategy:cpu_constrained -pkeyopt state_filename:xmss_catalyst_mixed_chain_root_private_key_state.bin -out xmss_catalyst_mixed_chain_root_private_key.pem

Intermediate private key:

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl genpkey -engine IQREngine -algorithm dilithium -pkeyopt parameter_set:A -out dilithium_catalyst_mixed_chain_intermediate_private_key.pem

Server private key:

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl genpkey -engine IQREngine -algorithm rainbow -pkeyopt parameter_set:A -out rainbow_catalyst_mixed_chain_private_key.pem

Once you've generated each certificate's private key, extract their public keys.

Root public key:

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl pkey -engine IQREngine -in xmss_catalyst_mixed_chain_root_private_key.pem -pubout -out xmss_catalyst_mixed_chain_root_public_key.pem

Intermediate public key:

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl pkey -engine IQREngine -in dilithium_catalyst_mixed_chain_intermediate_private_key.pem -pubout -out dilithium_catalyst_mixed_chain_intermediate_public_key.pem

Server public key:

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl pkey -engine IQREngine -in rainbow_catalyst_mixed_chain_private_key.pem -pubout -out rainbow_catalyst_mixed_chain_public_key.pem

Choose a curve for the ECC mixed chain certificate.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl ecparam -out ecdsa_catalyst_mixed_chain_parameters.pem -name secp384r1

Create CSRs and generate certificates

With all cryptographic keys generated, you're ready to create a CSR for each certificate in the chain and generate the root, intermediate, and server certificates.

First, create a CSR for the root issuer.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl req -new -newkey ec:ecdsa_catalyst_mixed_chain_parameters.pem -keyout ecdsa_without_xmss_catalyst_mixed_chain_root_private_key.pem -out ecdsa_without_xmss_x509_catalyst_mixed_chain_root_req.pem -config ./configs/root_req.cfg -nodes

Next you need to create a self-signed X509 certificate for the root.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl x509 -req -set_serial 8026 -extfile ./configs/root_req.cfg -in ecdsa_without_xmss_x509_catalyst_mixed_chain_root_req.pem -signkey ecdsa_without_xmss_catalyst_mixed_chain_root_private_key.pem -out ecdsa_without_xmss_x509_catalyst_mixed_chain_root_certificate.pem

After that, extend the root certificate into a hybrid root certificate.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl x509QSDirectExtend -engine /app/digicert-pqc/connector/lib/libiqre_engine.so -x509in ecdsa_without_xmss_x509_catalyst_mixed_chain_root_certificate.pem -x509out xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem -privin ecdsa_without_xmss_catalyst_mixed_chain_root_private_key.pem -pubqs xmss_catalyst_mixed_chain_root_public_key.pem -privqs xmss_catalyst_mixed_chain_root_private_key.pem::xmss_catalyst_mixed_chain_root_private_key_state.bin -privqs_engine

Now you can create the CSR for the intermediate certificate.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl req -new -newkey ec:ecdsa_catalyst_mixed_chain_parameters.pem -keyout ecdsa_without_dilithium_catalyst_mixed_chain_intermediate_private_key.pem -out ecdsa_without_dilithium_x509_catalyst_mixed_chain_intermediate_req.pem -config ./configs/intermediate_req.cfg -nodes

Extend the intermediate certificate CSR into a hybrid CSR.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl reqQSExtend -engine /app/digicert-pqc/connector/lib/libiqre_engine.so -reqin ecdsa_without_dilithium_x509_catalyst_mixed_chain_intermediate_req.pem -reqout dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_req.pem -privin ecdsa_without_dilithium_catalyst_mixed_chain_intermediate_private_key.pem -pubqs dilithium_catalyst_mixed_chain_intermediate_public_key.pem -privqs dilithium_catalyst_mixed_chain_intermediate_private_key.pem

Next, generate the intermediate certificate.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl x509 -req -set_serial 8014 -extfile ./configs/intermediate_req.cfg -in dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_req.pem -CA xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem -CAkey ecdsa_without_xmss_catalyst_mixed_chain_root_private_key.pem -out ecdsa_without_dilithium_x509_catalyst_mixed_chain_intermediate_certificate.pem

Extend the intermediate certificate into a hybrid intermediate certificate.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl x509QSExtend -engine /app/digicert-pqc/connector/lib/libiqre_engine.so -x509in ecdsa_without_dilithium_x509_catalyst_mixed_chain_intermediate_certificate.pem -x509out dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem -reqin dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_req.pem -privqs xmss_catalyst_mixed_chain_root_private_key.pem::xmss_catalyst_mixed_chain_root_private_key_state.bin -privqs_engine

Now that the root and intermediate certificates have been generated, the next step is to generate the server certificate.

First you need to create the CSR for the server certificate.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl req -new -newkey ec:ecdsa_catalyst_mixed_chain_parameters.pem -keyout ecdsa_without_rainbow_catalyst_mixed_chain_private_key.pem -out ecdsa_without_rainbow_x509_catalyst_mixed_chain_req.pem -config ./configs/server_req.cfg -nodes

Then extend the server certificate CSR into a hybrid CSR.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl reqQSExtend -engine /app/digicert-pqc/connector/lib/libiqre_engine.so -reqin ecdsa_without_rainbow_x509_catalyst_mixed_chain_req.pem -reqout rainbow_ecdsa_x509_catalyst_mixed_chain_server_req.pem -privin ecdsa_without_rainbow_catalyst_mixed_chain_private_key.pem -pubqs rainbow_catalyst_mixed_chain_public_key.pem -privqs rainbow_catalyst_mixed_chain_private_key.pem

After that you can generate the server certificate.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl x509 -req -set_serial 8015 -req -extfile ./configs/server_req.cfg -in rainbow_ecdsa_x509_catalyst_mixed_chain_server_req.pem -CA dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem -CAkey ecdsa_without_dilithium_catalyst_mixed_chain_intermediate_private_key.pem -out ecdsa_without_rainbow_x509_catalyst_mixed_chain_certificate.pem

And finally, extend the server certificate into a hybrid server certificate.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl x509QSExtend -engine /app/digicert-pqc/connector/lib/libiqre_engine.so -x509in ecdsa_without_rainbow_x509_catalyst_mixed_chain_certificate.pem -x509out rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem -reqin rainbow_ecdsa_x509_catalyst_mixed_chain_server_req.pem -privqs dilithium_catalyst_mixed_chain_intermediate_private_key.pem

Verify the certificate chain

With all the certificates created, you're ready to verify that you have a functional hybrid certificate chain.

First, verify that the hybrid chain works using legacy cryptography.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl verify -engine IQREngine -verbose -CAfile xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem -untrusted dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem

You should see this output:

bash

engine "IQREngine" set.
rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem: OK

Next, verify that the hybrid certificate chain works using quantum-safe cryptography.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl x509QSVerify -engine /app/digicert-pqc/connector/lib/libiqre_engine.so -root xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem -untrusted dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem -cert rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem

Which should provide this output:

bash

engine "IQREngine" set.
2 : ok : /C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=DigiCert PQC Root
1 : ok : /C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=DigiCert PQC Test Intermediate CA
0 : ok : /C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=digicert.pqc
Success!!

And to verify all files were created, execute an ls command . If you were successful, you should see an output like this:

bash

configs
dilithium_catalyst_mixed_chain_intermediate_private_key.pem
dilithium_catalyst_mixed_chain_intermediate_public_key.pem
dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem
dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_req.pem
ecdsa_catalyst_mixed_chain_parameters.pem
ecdsa_without_dilithium_catalyst_mixed_chain_intermediate_private_key.pem
ecdsa_without_dilithium_x509_catalyst_mixed_chain_intermediate_certificate.pem
ecdsa_without_dilithium_x509_catalyst_mixed_chain_intermediate_req.pem
ecdsa_without_rainbow_catalyst_mixed_chain_private_key.pem
ecdsa_without_rainbow_x509_catalyst_mixed_chain_certificate.pem
ecdsa_without_rainbow_x509_catalyst_mixed_chain_req.pem
ecdsa_without_xmss_catalyst_mixed_chain_root_private_key.pem
ecdsa_without_xmss_x509_catalyst_mixed_chain_root_certificate.pem
ecdsa_without_xmss_x509_catalyst_mixed_chain_root_req.pem
rainbow_catalyst_mixed_chain_private_key.pem
rainbow_catalyst_mixed_chain_public_key.pem
rainbow_ecdsa_x509_catalyst_mixed_chain_server_certificate.pem
rainbow_ecdsa_x509_catalyst_mixed_chain_server_req.pem
xmss_catalyst_mixed_chain_root_private_key.pem
xmss_catalyst_mixed_chain_root_private_key_state.bin
xmss_catalyst_mixed_chain_root_public_key.pem
xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem

Test your certificate chain using s_server and s_client

To test your quantum-safe hybrid certificate chain, use OpenSSL's s_server and s_client utilities. To use both utilities simultaneously, open two terminal sessions: one for the server and one for the client.

First, add the CN value of the server certificate to your hosts file.

bash

echo "$(hostname -I) digicert.pqc" | sudo tee -a /etc/hosts

Next, make sure you're in the /app/digicert-pqc/certs directory.

bash

cd /app/digicert-pqc/certs

Then, in one of your open terminals, start the server.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl s_server -engine IQREngine -cert dilithium_ecdsa_x509_catalyst_mixed_chain_intermediate_certificate.pem -certform PEM -key dilithium_catalyst_mixed_chain_intermediate_private_key.pem -keyform PEM -debug -tls1_2

After executing the above command, you should see this output:

bash

engine "IQREngine" set.
Using default temp DH parameters
ACCEPT

Next, switch to the second terminal window, making sure you're in the /app/digicert-pqc/certs directory.

bash

cd /app/digicert-pqc/certs

Then, use the s_client utility to connect to the running server.

bash

/app/digicert-pqc/pqpki-openssl-1.0.2r/bin/openssl s_client -engine IQREngine -CAfile xmss_ecdsa_x509_catalyst_mixed_chain_root_certificate.pem -showcerts -tls1_2 -cipher 'ECDHE-NHDH-DILM-AES256-GCM-SHA384'

If everything's configured properly, in the terminal window running the s_client utility, you should see this output:

bash

engine "IQREngine" set.
CONNECTED(00000003)
depth=1 C = US, ST = Utah, L = Lehi, O = "DigiCert, Inc.", OU = DigiCert PQC, CN = DigiCert PQC Root
verify return:1
depth=0 C = US, ST = Utah, L = Lehi, O = "DigiCert, Inc.", OU = DigiCert PQC, CN = DigiCert PQC Test Intermediate CA
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=DigiCert PQC Test Intermediate CA
   i:/C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=DigiCert PQC Root
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=DigiCert PQC Test Intermediate CA
issuer=/C=US/ST=Utah/L=Lehi/O=DigiCert, Inc./OU=DigiCert PQC/CN=DigiCert PQC Root
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 9868 bytes and written 2331 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-NHDH-DILM-AES256-GCM-SHA384
Server public key is 521 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-NHDH-DILM-AES256-GCM-SHA384
    Session-ID: {{Session-ID}}
    Session-ID-ctx: 
    Master-Key: {{Master-Key}}
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    [...]


    Start Time: 1563994600
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

In the terminal window running the s_server utility, you should see this output:

bash

read from 0x5581e0750b80 [0x5581e07656f3] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 96                                    .....
read from 0x5581e0750b80 [0x5581e07656f8] (150 bytes => 150 (0x96))
0000 - 01 00 00 92 03 03 d9 c0-5a 73 35 d0 4e f2 31 f6   ........Zs5.N.1.
[...]
write to 0x5581e0750b80 [0x5581e076e100] (71 bytes => 71 (0x47))
0000 - 16 03 03 00 42 02 00 00-3e 03 03 c2 3b df 2f 01   ....B...>...;./.
[...]
write to 0x5581e0750b80 [0x5581e0769c43] (4953 bytes => 4953 (0x1359))
0000 - 16 03 03 13 54 0b 00 13-50 00 13 4d 00 13 4a 30   ....T...P..M..J0
[...]
write to 0x5581e0750b80 [0x5581e0769c43] (4609 bytes => 4609 (0x1201))
0000 - 16 03 03 11 fc 0c 00 11-f8 03 00 17 41 04 0d 97   ............A...
[...]
write to 0x5581e0750b80 [0x5581e076e100] (9 bytes => 9 (0x9))
0000 - 16 03 03 00 04 0e 00 00-00                        .........
read from 0x5581e0750b80 [0x5581e07656f3] (5 bytes => 5 (0x5))
0000 - 16 03 03 08 48                                    ....H
read from 0x5581e0750b80 [0x5581e07656f8] (2120 bytes => 2120 (0x848))
0000 - 10 00 08 44 41 04 29 0a-07 84 0c f3 a4 e4 3e d1   ...DA.).......>.
[...]
read from 0x5581e0750b80 [0x5581e07656f3] (5 bytes => 5 (0x5))
0000 - 14 03 03 00 01                                    .....
read from 0x5581e0750b80 [0x5581e07656f8] (1 bytes => 1 (0x1))
0000 - 01                                                .
read from 0x5581e0750b80 [0x5581e07656f3] (5 bytes => 5 (0x5))
0000 - 16 03 03 00 28                                    ....(
read from 0x5581e0750b80 [0x5581e07656f8] (40 bytes => 40 (0x28))
0000 - e1 d7 30 8b 12 ef d1 dc-31 90 97 d0 0e 54 9c aa   ..0.....1....T..
[...]
write to 0x5581e0750b80 [0x5581e076e100] (175 bytes => 175 (0xAF))
0000 - 16 03 03 00 aa 04 00 00-a6 00 00 1c 20 00 a0 02   ............ ...
[...]
write to 0x5581e0750b80 [0x5581e076e100] (6 bytes => 6 (0x6))
0000 - 14 03 03 00 01 01                                 ......
write to 0x5581e0750b80 [0x5581e076e100] (45 bytes => 45 (0x2D))
0000 - 16 03 03 00 28 d0 99 97-94 6d a1 5c f8 b0 c0 65   ....(....m.\...e
[...]
-----BEGIN SSL SESSION PARAMETERS-----
[...]
-----END SSL SESSION PARAMETERS-----
Shared ciphers:ECDHE-NHDH-DILM-AES256-GCM-SHA384:ECDHE-NHDH-SIDH-DILM-AES256-GCM-SHA384
Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1:HSS+SHA512:XMSS+SHA512:XMSSmt+SHA512:DILITHIUM+SHA512:DILITHIUM+SHA512:0xE0+SHA512
Shared Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1:HSS+SHA512:DILITHIUM+SHA512:DILITHIUM+SHA512
Supported Elliptic Curve Point Formats: uncompressed:ansiX962_compressed_prime:ansiX962_compressed_char2
Supported Elliptic Curves: P-256:P-521:brainpoolP512r1:brainpoolP384r1:P-384:brainpoolP256r1:secp256k1:B-571:K-571:K-409:B-409:K-283:B-283:0xFE01
Shared Elliptic curves: P-256:P-521:brainpoolP512r1:brainpoolP384r1:P-384:brainpoolP256r1:secp256k1:B-571:K-571:K-409:B-409:K-283:B-283:UNDEF
CIPHER is ECDHE-NHDH-DILM-AES256-GCM-SHA384
Secure Renegotiation IS supported

Congratulations! You've successfully created a quantum-safe hybrid certificate chain using DigiCert's PQC toolkit and the ISARA Catalyst OpenSSL Connector engine.

Introduction

PQC toolkit contents

Prerequisites

Prepare your environment

Download and extract toolkit

Download PQC toolkit

Extract PQC toolkit files

Patch and compile OpenSSL

Create a hybrid certificate chain

Generate private and public keys

Create CSRs and generate certificates

Verify the certificate chain

Test your certificate chain using s_server and s_client

About