03 · Migration & cryptographic agility
Move without breaking production.
Execute the migration as a series of small, reversible changes: hybrid first, then pure PQC where standards and vendors allow. Every change is tested, recorded, and attributable.
The problem
What this stage removes.
Algorithm changes touch TLS termination, certificate chains, HSMs, firmware, and third-party dependencies at once. A big-bang cutover is how organizations turn a compliance deadline into an outage.
Hybrid key exchange
Roll out X25519 with ML-KEM-768 where interoperability requires it, with negotiated fallback and measured performance impact.
PQC certificate issuance
Issue ML-DSA and hybrid certificates from modern CAs, including staged trust-store distribution and chain validation testing.
Quantum-safe code signing
Migrate software and firmware signing to ML-DSA or the stateful hash-based schemes CNSA 2.0 requires — LMS and XMSS under SP 800-208.
HSM and KMS alignment
Track which modules support which algorithms, and sequence hardware refresh against the FIPS 140-3 validation queue instead of discovering the gap in production.
Capabilities
What it actually does.
Capability detail, not marketing categories.
Hybrid key exchange
Roll out X25519 with ML-KEM-768 where interoperability requires it, with negotiated fallback and measured performance impact.
PQC certificate issuance
Issue ML-DSA and hybrid certificates from modern CAs, including staged trust-store distribution and chain validation testing.
Quantum-safe code signing
Migrate software and firmware signing to ML-DSA or the stateful hash-based schemes CNSA 2.0 requires — LMS and XMSS under SP 800-208.
HSM and KMS alignment
Track which modules support which algorithms, and sequence hardware refresh against the FIPS 140-3 validation queue instead of discovering the gap in production.
Staged rollout and rollback
Canary by service, measure handshake latency and failure rates, and keep a tested path back until the change is proven.
Dependency remediation
Produce upgrade guidance and open-source patches where you control the dependency, and vendor pressure where you do not.
Output
What you get at the end.
- Migrated TLS and certificate chains
- Quantum-safe signed software and firmware
- Change records and rollback runbooks
- Test evidence for each migrated service
Coverage
Where it connects.
- EJBCA, ADCS, and commercial CAs
- HSMs and cloud KMS services
- Load balancers, service mesh, and API gateways
- CI/CD signing pipelines
- Terraform and infrastructure policy engines
Services
The work behind the capability.
Platform output only matters if someone acts on it. These engagements deliver the change.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.