Issue PQC Dilithium certificates

You can use DigiCert® Trust Lifecycle Manager to issue and manage (revoke, suspend/resume, or recover) private post-quantum cryptography (PQC) certificates using the Dilithium (MLDSA) algorithm with the supported key types below.

Key type	Key sizes	Signing algorithms
MLDSA	MLDSA 10496 MLDSA 15616 MLDSA 20736	MLDSA-44 MLDSA-65 MLDSA-87

Before you begin

You need at least one private issuing CA available in DigiCert® CA Manager.

Note

Contact your DigiCert account representative or system administrator if you need help verifying or creating a CA.

Available certificate templates

Use the following base templates to create certificate profiles in Trust Lifecycle Manager for requesting PQC Dilithium certificates from a private issuing CA in DigiCert® CA Manager. Supported enrollment methods include CSR, EST, and REST API.

Template name	Seat type
`Generic Device Certificate`	Device
`Generic Private Server Certificate`	Server
`Generic User Certificate`	User
`Private S/MIME Secure Email`	User

Create a certificate profile

To create a certificate profile for issuing Dilithium certificates:

From the Trust Lifecycle Manager main menu, select Manage > Profiles.
Select the Create profile from template action at the top of the page.
Select one of the base templates listed above as the basis for creating the certificate profile:
- Generic Device Certificate to enroll certificates for devices.
- Generic Private Server Certificate to enroll certificates for private servers.
- Generic User Certificate to enroll certificates for users.
- Private S/MIME Secure Email to enroll certificates for users for secure email.
Work through the profile creation wizard, focusing on the PQC-related options described below and making other selections for your business needs and types of certificates you want to issue. After filling out each screen, select Next to move to the next screen.
On the initial Primary options screen of the profile creation wizard, configure the:
- General information: Select the applicable business unit and issuing CA for the certificates.
- Enrollment method: Select one of the following.
  - CSR to enroll from a CSR using a web-based enrollment flow.
  - EST to enroll from a remote client using the EST protocol (not available for S/MIME certificates).
  - REST API to enroll from a CSR using the Trust Lifecycle Manager REST API.
- Authentication method: Select one of the available authentication methods for the enrollment method you selected.
On the Certificate options screen:
- Key type: Select MLDSA.
- Key sizes: Select one or more Dilithium key sizes to allow for issuance.
On the Additional options screen:
- Certificate delivery format: Select whether to deliver certificates in X.509 or PKCS#7 format. For PKCS#7, select an option for how to include the CA chain.
Select Create to save the new certificate profile.

CSRs and private keys for testing

You can use these CSRs and their corresponding private keys to test issuance of Dilithium (MLDSA) certificates via API or web-based enrollment.

Key type/size	CSR	Private key
MLDSA 10496	digi_dil2csr.pem	digi_dil2priv.pem
MLDSA 15616	digi_dil3csr.pem	digi_dil3priv.pem
MLDSA 20736	digi_dil5csr.pem	digi_dil5priv.pem

Test Dilithium issuance via web-based enrollment

Follow these steps to test issuance of PQC Dilithium certificates from CSR via web-based enrollment using one of the supported authentication methods.

Before you begin

Create a certificate profile for Dilithium certificates (key type MLDSA) that uses the CSR enrollment method and one of the supported authentication methods (for example, Manual approval). Copy the Enrollment URL generated when saving the profile.
Download a testing CSR from the above table for one of the allowed Key sizes you configured in the Dilithium certificate profile.

Request a Dilithium certificate

Use a web browser to access the Enrollment URL for the Dilithium certificate profile you created. You can get this URL from the profile details page, or from the self-service portal if enabled.
Complete the enrollment form and upload the Dilithium testing CSR you downloaded from the above table.
Select Submit to submit the enrollment request.

Approve the enrollment request

Log into Trust Lifecycle Manager as a user with the Manager or User and certificate manager role.
Use one of the following methods to load the pending enrollment requests:
- Select Manage > Enrollments from the Trust Lifecycle Manager main menu. Filter the list as needed.
- On the Dashboard page, in the Pending requests widget, select the numbered link under Pending approval to load the pending enrollments.
Find the pending enrollment for the Dilithium certificate request. Select the seat ID to review the enrollment before approving, or to approve immediately open the actions (three dots) menu and select Approve.

Download the certificate

After approving the enrollment request, an email is sent to the requester address with a download link.
Select the link in the confirmation email and follow the instructions to download the new Dilithium certificate.