Chapitre 8 sur 8

Hardening, governance and what comes next

A configuration baseline, the operational controls around it, and the move to post-quantum cryptography.

Environ 11 minutes de lecture

À la fin de ce chapitre, vous saurez

  • Describe a minimum TLS baseline for a public service
  • List the governance controls that keep a baseline in place
  • Explain why crypto-agility matters for TLS

Dans ce chapitre

  1. 1. A minimum baseline
  2. 2. Governance: who owns what
  3. 3. Post-quantum and agility
  4. 4. Where to go next

01A minimum baseline

  • TLS 1.2 and 1.3 only; TLS 1.0 and 1.1 disabled everywhere, including internal services
  • AEAD cipher suites with ECDHE key exchange only
  • Certificates from a managed inventory, renewed automatically
  • SHA-256 or stronger signatures; RSA 3072 or ECDSA P-256 minimum
  • OCSP stapling enabled where the chain supports it
  • HSTS after every subdomain is confirmed HTTPS-only
  • Logging of handshake failures and certificate serials for correlation

A baseline is only real if it is enforced in configuration templates and checked continuously. Documentation drifts; templates do not.

02Governance: who owns what

ControlOwnerEvidence
Cipher and protocol policyPlatform engineeringConfiguration in source control
Certificate inventory and renewalPKI or platform teamInventory report, renewal logs
Key custodySecurity operationsHSM access records, ceremony documents
Exception handlingRisk ownerApproved exceptions with expiry dates

03Post-quantum and agility

Large quantum computers would break the public key algorithms in use today, and recorded traffic can be decrypted later. Standards bodies have published post-quantum algorithms, and governments have published migration timelines that range from guidance to binding policy.

  • Agility means you can change algorithm, key size and certificate source without redesigning the service
  • Hybrid key exchange, combining classical and post-quantum algorithms, is the pragmatic first step in browsers
  • Long-lived systems and long-lived secrets are the highest priority to migrate
  • Track the mandates that apply to you: they differ in legal force, scope and dates

Our PQC mandates tracker summarises the published national and regional positions, with sources, so you can see which obligations actually apply to your organisation.

04Where to go next

  • Practise the debugging workflow until it is routine
  • Read the PKI track if certificate structure and chains still feel abstract
  • Read the ADCS track if you work in Windows environments
  • Sit the certification exam to confirm the vocabulary and the reasoning
Why is TLS 1.0 still a problem even inside a private network?

It permits algorithms and constructions with known weaknesses; lateral movement makes internal traffic reachable by attackers.

What does crypto-agility look like in a TLS service?

Algorithm and certificate selection are configuration, not code, and can be changed and tested without a redeploy.

À retenir

  • A baseline is a small set of enforced, continuously checked settings
  • Governance assigns owners and evidence, not just intentions
  • Crypto-agility decides how quickly you can respond to the next algorithm break
  • Post-quantum migration is already scheduled policy in several jurisdictions
PrécédentDebugging handshake failuresCours terminéPasser l’examen de certification

Approfondir :ACME end-user guidePKI Trust Manager admin guide