Post-quantum readiness starts with knowing your certificates

A certificate failure can look like a broken login, a disconnected device, or a service that suddenly cannot talk to another service. That makes post-quantum planning an operations problem as well as a cryptography problem.

What changed in the news

In an October 8 post, Microsoft described why authentication needs its own preparation for post-quantum cryptography. Certificate chains, trust anchors, devices, applications, and hardware security modules all affect compatibility. The company recommends controlled testing before changes reach production. Read Microsoft's research.

NIST has published three foundational post-quantum standards and encourages organizations to identify systems that use vulnerable algorithms and plan migration. Standards being available does not tell you whether every product in your environment is ready. See NIST's current guidance.

Start with an inventory you can use

For a small team, a useful first document is a table that connects a certificate to the service it protects and the person responsible for it. Include the places where a failure would stop work: remote access, public websites, internal applications, device management, and integrations.

Record the owner, issuer, renewal process, dependent clients, and vendor support path. An entry that says only “the IT provider handles it” is still a gap. You need enough information to ask a concrete question and recognize an unexpected change.

Ask the vendor a specific question

“Are you quantum safe?” is difficult to act on. Ask which product version supports the relevant capability, what has been tested, which clients remain unsupported, and how rollback works. Keep the answer with the asset record. A roadmap and a shipping feature are different kinds of evidence.

Keep testing separate from live changes

My practical recommendation is to choose one low-impact workflow for a non-production test. Write down the normal behavior first, including the clients that connect and the expected renewal process. Then test the change against that baseline. A successful browser connection alone does not establish that every device, integration, or recovery path works.

You do not need to solve the whole migration this week. You do need to replace a vague future concern with an owner, an inventory, a vendor question, and a test you can repeat.