🔐 Post-Quantum X.509 Certificate Chain

🎯 What This Is

A complete, working post-quantum X.509 certificate chain you can download and verify yourself. Unlike classical PKI built on RSA or ECDSA — both breakable by Shor's algorithm on a large quantum computer — every signature in this chain is quantum-resistant:

A hash-based root matters: even if lattice cryptanalysis ever advances, the trust anchor rests only on the security of SHA-2. That is the same defense-in-depth pattern the CA/Browser ecosystem is converging on for post-quantum roots.

📥 Download the Chain

All certificates are PEM-encoded X.509v3, using the final NIST FIPS 204/205 algorithm identifiers and key encodings:

Root CA SHA-256 fingerprint — confirm it matches after download:

A7:8A:6E:45:85:63:E0:6D:A5:06:B6:FF:37:AD:6B:91:87:36:2C:E0:00:FE:40:EF:6C:1D:5B:EF:40:D9:10:DC

🔍 Verify It Yourself (OpenSSL 3.5+)

OpenSSL 3.5 and later verify ML-DSA and SLH-DSA signatures natively. Download the chain and run:

curl -sO https://pqcrypta.com/pqc/root-ca.crt
curl -sO https://pqcrypta.com/pqc/ca-chain.pem
curl -sO https://pqcrypta.com/pqc/server.crt

openssl verify -CAfile root-ca.crt -untrusted ca-chain.pem server.crt
# server.crt: OK

Inspect the post-quantum signature algorithms directly:

openssl x509 -in root-ca.crt -noout -text | grep "Signature Algorithm"
#   Signature Algorithm: SLH-DSA-SHA2-256s
openssl x509 -in server.crt -noout -text | grep "Signature Algorithm"
#   Signature Algorithm: ML-DSA-87

🌐 Live Post-Quantum TLS Endpoint

This chain is not just downloadable — it is served live. pqc.pqcrypta.com:443 terminates TLS 1.3 on pqcrypta-proxy (Rustls) with the ML-DSA-87 certificate above: the server signs its CertificateVerify with ML-DSA-87, and combined with hybrid ML-KEM key exchange the handshake is post-quantum end to end. Connect with OpenSSL 3.5+:

OPENSSL_CONF=/dev/null openssl s_client -connect pqc.pqcrypta.com:443 \
    -sigalgs mldsa87 -groups X25519MLKEM768 -CAfile root-ca.crt

# Peer signature type: ML-DSA-87
# Negotiated TLS1.3 group: X25519MLKEM768
# Verify return code: 0 (ok)

OpenSSL 3.5 offers ML-DSA signature schemes by default, so the explicit flags are optional — openssl s_client -connect pqc.pqcrypta.com:443 -CAfile root-ca.crt alone completes the post-quantum handshake. You can also fetch content over the PQ session with curl, if your curl is linked against OpenSSL 3.5+:

curl https://pqc.pqcrypta.com/pqc/cert-info.json \
    --sigalgs mldsa87 --curves X25519MLKEM768 --cacert root-ca.crt

The endpoint deliberately refuses clients that do not offer mldsa87 in their signature_algorithms — there is no classical fallback certificate on this hostname (a classical-only client receives a TLS handshake_failure alert). That is why a normal browser visit fails: browsers do not offer ML-DSA signature schemes yet. When they do, this endpoint is already waiting.

🖥️ Installing the Root in Your Trust Store

Reality check: no mainstream browser can validate ML-DSA or SLH-DSA certificate signatures during a TLS handshake yet — browser post-quantum support today covers key exchange (X25519MLKEM768), not certificates. Installing this root prepares your trust store for post-quantum PKI and lets OS tooling (and the OpenSSL commands above) verify the chain; it will not turn the padlock green on its own.

📜 Certificate Details (Live from the Chain)

🚀 Live PQC Encryption Demonstration

The certificates above prove post-quantum signatures work in X.509 today. This demo proves post-quantum encryption works in production today — a full generate → encrypt → decrypt round trip against the live PQ Crypta API using ML-KEM-1024 with pure post-quantum signatures:

🔬 Technical Stack

💡 Why Post-Quantum PKI Matters

TLS key exchange is going post-quantum first — hybrid ML-KEM is already deployed by major browsers — because recorded traffic can be decrypted retroactively ("harvest now, decrypt later"). Certificates come next: signatures can't be forged retroactively, but the WebPKI must migrate before quantum computers arrive, and rotating a global trust hierarchy takes years. The families involved:

• Lattice-based: ML-KEM and ML-DSA (FIPS 203/204) — fast, compact, the operational workhorses
• Hash-based: SLH-DSA (FIPS 205) — larger and slower, but resting only on hash function security; ideal for roots of trust
• Code-based: Classic McEliece (ISO/IEC 18033-2) and HQC (NIST's backup KEM) — independent mathematical foundations

This chain demonstrates that a complete post-quantum certificate hierarchy — conservative hash-based anchor, efficient lattice-based operations — is buildable and verifiable with standard tooling today.