White paper WP-019
Post-Quantum PKI Migration: ML-KEM and ML-DSA in Production
A cutover plan for PKI teams who cannot wait for a perfect standard.
At a glance
- Paper
- WP-019
- Topic
- Post-Quantum PKI Migration: ML-KEM and ML-DSA in Production
- Format
- PDF + web summary
- Signatures
- ML-DSA-65 post-quantum (NIST FIPS 204)
- Sandbox
- Reproducible at affix-io.com/sandbox
- Company
- AffixIO, Wales, UK
Post-Quantum PKI Migration: ML-KEM and ML-DSA in Production is an AffixIO technical paper. A cutover plan for PKI teams who cannot wait for a perfect standard.
NIST finalised ML-KEM and ML-DSA. Your certificates still expire on RSA. This is a practitioner's migration guide: hybrid TLS, staged trust anchors, HSM quirks, and rollback paths we have seen in production cutovers.
Summary
NIST finalised ML-KEM and ML-DSA. Your certificates still expire on RSA. This is a practitioner's migration guide: hybrid TLS, staged trust anchors, HSM quirks, and rollback paths we have seen in production cutovers.
Download the full PDF for technical detail, diagrams, and reproduction steps. Public sandbox: affix-io.com/sandbox.
Related reading
Frequently asked questions
When should we migrate PKI to post-quantum algorithms?
Now, using hybrid schemes. Harvest-now-decrypt-later means long-lived TLS and document signatures are already exposed.
What is hybrid key exchange?
Clients and servers negotiate both a classical and a post-quantum shared secret so you gain quantum resistance without breaking legacy clients.
Do HSMs support ML-DSA yet?
Major FIPS 140-2 Level 3 HSMs ship ML-DSA firmware, but key ceremony and CSR formats differ by vendor. Plan a staging cluster first.