Services · Infrastructure
PKI that survives the transition to post-quantum.
Build or modernize the certificate infrastructure the migration depends on: cryptographic agility, automated lifecycle, and hybrid or PQC issuance when you are ready.
The problem
Why this exists.
Most PKI was built for a world of long-lived certificates and manual renewal. Adding post-quantum algorithms to that design multiplies chain complexity, validation pressure, and outage risk. The migration exposes PKI debt that has been invisible for a decade.
What changes
- A CA hierarchy designed for algorithm rollover
- Automated issuance and renewal at fleet scale
- HSM-backed keys with validated modules
- A tested path to hybrid and PQC certificates
Delivery
How the engagement runs.
A sequence you can plan around, with a decision or a working artifact at the end of every phase.
- 01
Assess
Inventory CAs, templates, trust stores, and renewal paths.
- 02
Design
Target hierarchy, key custody, and algorithm-rollover strategy.
- 03
Migrate
Stand up automation, then move workloads in waves.
- 04
Operate
Monitoring, expiry prevention, and validation of PQC chains.
Deliverables
What you keep.
- CA hierarchy and trust-store design
- HSM and KMS integration
- ACME and lifecycle automation
- Certificate policy and practice statement updates
- Hybrid and PQC issuance pilot
- Certificate Transparency monitoring
Fit
Who this is for.
- Organizations running ADCS at scale
- Teams planning an EJBCA or cloud-PKI move
- Enterprises with certificate expiry incidents
- Firms that need CNSA 2.0-compliant issuance
Typical duration
8–16 weeks
Scope and elapsed time depend on access, estate size, and change control. We confirm both in writing before work starts.
Not sure which engagement fits? Start with the ten-minute assessment, or ask us directly.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.