Hardening, governance and what comes next

• TLS 1.2 and 1.3 only; TLS 1.0 and 1.1 disabled everywhere, including internal services
• AEAD cipher suites with ECDHE key exchange only
• Certificates from a managed inventory, renewed automatically
• SHA-256 or stronger signatures; RSA 3072 or ECDSA P-256 minimum
• OCSP stapling enabled where the chain supports it
• HSTS after every subdomain is confirmed HTTPS-only
• Logging of handshake failures and certificate serials for correlation

A baseline is only real if it is enforced in configuration templates and checked continuously. Documentation drifts; templates do not.

Large quantum computers would break the public key algorithms in use today, and recorded traffic can be decrypted later. Standards bodies have published post-quantum algorithms, and governments have published migration timelines that range from guidance to binding policy.

• Agility means you can change algorithm, key size and certificate source without redesigning the service
• Hybrid key exchange, combining classical and post-quantum algorithms, is the pragmatic first step in browsers
• Long-lived systems and long-lived secrets are the highest priority to migrate
• Track the mandates that apply to you: they differ in legal force, scope and dates

Our PQC mandates tracker summarises the published national and regional positions, with sources, so you can see which obligations actually apply to your organisation.

• Practise the debugging workflow until it is routine
• Read the PKI track if certificate structure and chains still feel abstract
• Read the ADCS track if you work in Windows environments
• Sit the certification exam to confirm the vocabulary and the reasoning