AFFIXIO
WP-019
AffixIO Research
Post-Quantum PKI Migration: ML-KEM and ML-DSA in Production
A cutover plan for PKI teams who cannot wait for a perfect standard.
NIST finalised ML-KEM and ML-DSA. Your certificates still expire on RSA. This is a practitioner's migration guide: hybrid TLS, staged trust anchors, HSM quirks, and rollback paths we have seen in production cutovers.
Summary
NIST finalised ML-KEM and ML-DSA. Your certificates still expire on RSA. This is a practitioner's migration guide: hybrid TLS, staged trust anchors, HSM quirks, and rollback paths we have seen in production cutovers.
Download the full PDF for technical detail, diagrams, and reproduction steps. Public sandbox: affix-io.com/sandbox.