ART-86 · Wave 18 · Post-Quantum Cryptography · TLS/PKI Migration

TLS / X.509 PKI Migration Planner

Sequences TLS and PKI migration from RSA/ECDSA to post-quantum algorithms. Builds a phased plan (root CAs → intermediates → leaf certificates), models payload impact per NIST FIPS 203/204, and flags interoperability risks. Reuses CBOM inventory from tool 499. Part of the pqc-tls-pki and pqc-hndl-protocol-plan chains.

NIST FIPS 203 · FIPS 204 ML-KEM-768 · ML-DSA-65 Hybrid / Composite / Replace

🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.

PKI configuration

PKIRoot CA count

PKIIntermediate CA count

PKILeaf certificate population

PKITLS versions in estate (select all that apply)

TLS 1.3 TLS 1.2 (legacy) TLS 1.0/1.1 (legacy)

Migration strategy

StrategyMigration approach

OptionalCBOM inventory reference (from tool 499)

ConstraintsInteroperability constraints (select all that apply)

legacy_tls12 no_dual_stack size_limited

–

Strategy

–

Est. Total Weeks

Phases

Migration phases

Phase	Target	Est. Weeks	Notes

Payload impact

New sig size (per cert)

–bytes

Algorithm refs (NIST FIPS 203/204)

          ML-KEM-768 PK: 1 184 bytes

          ML-DSA-65 sig: 3 309 bytes

          RSA-2048 sig: 256 bytes

          Hybrid overhead: ~2.1×

Interoperability risks

Rollback points

Compliance flags

Algorithm sizes: NIST FIPS 203 (Aug 2024) — ML-KEM-768 public key 1 184 bytes · NIST FIPS 204 (Aug 2024) — ML-DSA-65 signature 3 309 bytes · Hybrid overhead multiplier ~2.1× (verify current primary source). Effort estimates are indicative — adjust for organisational capacity. DECISION-SUPPORT DRAFT.

OpenChainGraph v0.4 artifact · execution_hash:

–