Planning for post-quantum cryptography
Trust Architecture Playbook: Issuance pillar
Quantum computing poses a long-term threat to RSA and ECC, the asymmetric algorithms that underpin today's enterprise PKI. A cryptographically relevant quantum computer (CRQC) could compromise certificate-based authentication, digital signatures, and the trust established by enterprise certificate hierarchies. With NIST's first PQC standards (FIPS 203, FIPS 204, and FIPS 205) finalized in 2024, organizations should begin inventorying PKI assets, assessing cryptographic dependencies, and developing a phased migration strategy to quantum-resistant cryptography.
PQC support in DigiCert Private CA
DigiCert® Private CA supports PQC certificate issuance for private-trust use cases. PQC certificates can be issued and managed through Trust Lifecycle Manager using the same certificate profile workflow as classical certificates. Supported enrollment methods include Admin web request (automated delivery), CSR (web-based), EST, and REST API.
Supported PQC signature algorithms
DigiCert Private CA can issue PQC certificates using the following signature algorithms:
ML-DSA (formerly CRYSTALS-Dilithium): The primary NIST-standardized PQC signature algorithm (FIPS 204). All three parameter sets are supported: MLDSA-44, MLDSA-65, and MLDSA-87. ML-DSA is the recommended algorithm for most use cases.
SLH-DSA (formerly SPHINCS+): A stateless hash-based signature scheme standardized in FIPS 205. All NIST-standardized SLH-DSA parameter sets are supported.
 |
HSM requirements
PQC key generation in DigiCert Private CA requires an HSM that supports PQC algorithms. If PQC is a defined or near-term requirement, factor HSM selection into your planning before provisioning any CA infrastructure. DigiCert Private CA supports different HSM options depending on the PQC signature algorithm:
Revocation requirements
CRL-based revocation is fully supported for ML-DSA and SLH-DSA certificates. OCSP is not yet supported for PQC certificates. Confirm that relying party systems in your environment support CRL-based revocation checking, since OCSP is not yet available as an alternative.
DigiCert-hosted Private CA: DigiCert's existing CRL infrastructure covers PQC certificates. No additional action is required.
Customer-hosted Private CA: Ensure your CRL infrastructure is provisioned and tested before issuing PQC certificates.
Additional PQC signature algorithms
FN-DSA is a lattice-based signature algorithm being standardized by NIST as FIPS 206, based on the Falcon algorithm submitted to the NIST PQC standardization process. FN-DSA is designed to produce compact public keys and signatures, resulting in smaller X.509 certificates than ML-DSA and SLH-DSA — making it attractive for bandwidth- and storage-constrained environments.
NIST status: In development (Draft FIPS 206; not yet a final standard). Because FIPS 206 has not been finalized, NIST may make changes to Falcon during standardization, so results obtained today are not guaranteed to carry forward once FN-DSA is finalized. Interested users can generate and evaluate Falcon-based X.509 certificates today using the DigiCert PQC Labs.
LMS is a stateful hash-based signature algorithm standardized in RFC 8554 and approved by NIST for use through SP 800-208 (Recommendation for Stateful Hash-Based Signature Schemes). LMS relies solely on the security of cryptographic hash functions and produces compact public keys and relatively small signatures, making it well suited for firmware signing, secure boot, and software update ecosystems where the signer can securely maintain signing state.
NIST status: Approved for use under NIST SP 800-208 (not a FIPS standard). LMS is intended for specialized applications that can safely manage signing state and is not recommended for general-purpose PKI or WebPKI certificate issuance.
XMSS is a stateful hash-based signature algorithm standardized in RFC 8391 and approved by NIST for use through SP 800-208. Like LMS, XMSS provides post-quantum security based solely on cryptographic hash functions while generating small public keys and relatively compact signatures compared to stateless hash-based schemes such as SLH-DSA. It is particularly well suited for firmware signing, secure boot, and long-lived trust anchors.
NIST status: Approved for use under NIST SP 800-208 (not a FIPS standard). XMSS requires careful management of signing state and is therefore intended for controlled signing environments rather than large-scale certificate authorities or public WebPKI deployments.
Hybrid PQC certificates
Hybrid PQC certificates combine a classical algorithm (such as RSA or ECDSA) and a PQC algorithm (such as ML-DSA) within a single certificate, allowing relying parties to validate against either algorithm during the transition to post-quantum cryptography.
NIST status: No ratified IETF standard currently exists for hybrid certificate composition. The emerging "Composite" signature approach is under active development within the IETF and is receiving significant industry attention, but standardization is not complete.
Aviso
DigiCert does not currently support issuance of hybrid PQC certificates, in order to prioritize standards-based implementations over pre-standard approaches. DigiCert is actively monitoring the Composite standard's progress and will evaluate support as the standards landscape and industry adoption evolve.
PQC readiness planning
PQC migration is a long-term project. Begin with these steps:
Inventory your cryptographic assets: Use Trust Lifecycle Manager's crypto hygiene reporting to identify all certificates using classical algorithms. This inventory is the foundation of your PQC migration plan.
Identify high-risk assets: Prioritize long-lived certificates, CA keys, and certificates protecting sensitive long-lived data. These are the most exposed to harvest-now-decrypt-later attacks, in which adversaries capture encrypted data today with the intent to decrypt it once quantum computing capabilities mature.
Assess HSM readiness: For private trust issuance, determine whether your existing HSMs support PQC algorithms and plan hardware upgrades accordingly.
Pilot PQC issuance: Issue PQC certificates in a test environment and validate chain building, revocation, and application compatibility before any production deployment.
Aviso
Building a cryptographic baseline is covered in the Baseline pillar of the DigiCert® Trust Architecture Playbook.