The Infrastructure Bottleneck for Most Migrations
Public key infrastructure is the bottleneck for most enterprise PQC migrations. Post-quantum certificates are dramatically larger than their classical counterparts, with cascade effects on certificate chains, validation, OCSP responses, TLS handshakes, and HSM storage. This in-depth, 8-hour course covers PKI modernization for the post-quantum era: dual-capability PKI design, certificate chain-size consequences, HSM inventory and firmware paths, trust anchor migration, and certificate lifecycle management during the transition.
Course Outline
Module 1. The Post-Quantum PKI Challenge
Why PKI is the infrastructure bottleneck. The certificate size problem: ML-DSA signatures are roughly an order of magnitude larger than ECDSA. Cascade effects: chain validation, OCSP response sizes, TLS handshake latency, and storage. Assessing your PKI’s readiness for post-quantum certificates.
Module 2. Dual-Capability PKI Design
Designing PKI that supports both classical and post-quantum certificates during transition. Dual-certificate hierarchies. Cross-signing strategies. Composite and hybrid certificate approaches. Managing two trust hierarchies in parallel.
Module 3. HSM and Trust Anchor Migration
HSM inventory and PQC support assessment. Firmware upgrade paths and vendor timelines. Trust anchor migration strategies. Root and intermediate CA migration sequencing. Key ceremony considerations for post-quantum roots.
Module 4. Certificate Lifecycle During Transition
Certificate lifecycle management with dual algorithms. Issuance, renewal, and revocation during transition. Automating certificate management for the migration. Monitoring and inventory for a mixed classical/post-quantum certificate estate.
Module 5. Protocol and Application Impact
How PKI changes affect TLS, code signing, S/MIME, and document signing. Application compatibility with larger certificates. Performance testing for PKI-dependent systems. Managing the transition for systems that cannot handle larger certificates.
Module 6. Migration Planning and Execution
Building a PKI migration plan. Sequencing PKI migration relative to the broader cryptographic migration. Testing and validation for PKI changes. Rollback planning. Coordinating PKI migration across the organization and with external partners.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background. Some courses assume security engineering experience.
Certificate of Completion
Upon completion, you will receive a Quantum Academy certificate of completion. CPE credits earned may apply toward Quantum Academy certification maintenance.
Who this course is for
PKI architects and operators, certificate lifecycle management owners, and the identity and infrastructure teams who will carry the migration. Both enterprise internal PKI and public trust operations.
If you do not own certificate infrastructure, this course goes deeper into it than you will need.
What you’ll be able to do afterward
- Design dual-capability PKI for the PQC transition period
- Assess certificate chain-size consequences of post-quantum signatures
- Plan HSM inventory assessment and firmware upgrade paths
- Design trust anchor migration strategy (long-lived anchors first)
- Manage certificate lifecycle during dual-stack operation
- Evaluate ACME protocol and automated certificate management for PQC
What you leave with
You leave with the course handbook, a PDF of the full material with the instructor notes written out in place of the slides’ bullet points, and a PDF copy of Quantum Ready, included at no extra cost. The handbook is yours to keep. For most organizations, that shared reference is the clearest return on a training budget.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Post-Quantum Foundation or PQCS Specialist Training give the grounding this course builds on. Neither is enforced. PQC Migration: Executing the Waves for the program PKI work belongs to, and PQCA Architect Training for the credential.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org and written by the practitioners who teach here. The people who teach this course are running migration programs inside organizations now, and the course covers what those programs hit.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.