Try Quantum-safe Cryptography PKI

Solution

Seamless support for Quantum-safe PKI with EJBCA

The reality is that there are still many unanswered questions, and it will take some time before all the pieces fall into place. EJBCA offers a seamless solution for issuing quantum-ready Public Key Infrastructure (PKI) certificates alongside the existing PKI within the same environment. This ensures a smooth experience with minimal disruption to your current infrastructure and environments. You can begin experimenting with the technology and gradually understand its relevance to your specific environment over time.

EJBCA supports ML-DSA (Dilithium) and NL-DSA (Falcon) algorithms for Root CAs, Issuing CAs, and End entities. While Certificate Revocation Lists (CRLs) can be generated, certain aspects such as Online Certificate Status Protocol (OCSP) and other protocols are still in the development phase and will be made available in the future.

Check out our how-tos and videos on:

• Issue ML-DSA (Dilithium) code signing certificate with EJBCA and sign code in SignServer
• Creating a quantum-ready hybrid certificate using the Bouncy Castle Kotlin project
• Try Hybrid certificates in preparations for quantum readiness 

Please note, the final standards for ML-KEM, ML-DSA and SLH-DSA were finalized in August 2024. We recommend only using standardized quantum-safe algorithms in production environments.