{
  "version": "2.0",
  "generated": "2026-07-19",
  "description": "PQ Crypta post-quantum X.509 demonstration chain, generated with OpenSSL 3.5 native FIPS 204/205 implementations",
  "certificate_chain": {
    "root_ca": {
      "file": "root-ca.crt",
      "signature_algorithm": "SLH-DSA-SHA2-256s (FIPS 205, hash-based)",
      "subject": "CN=PQ Crypta Root CA 2026, O=PQ Crypta",
      "validity_years": 10,
      "dates": "notBefore=Jul 19 17:18:42 2026 GMT\nnotAfter=Jul 16 17:18:42 2036 GMT",
      "sha256_fingerprint": "A7:8A:6E:45:85:63:E0:6D:A5:06:B6:FF:37:AD:6B:91:87:36:2C:E0:00:FE:40:EF:6C:1D:5B:EF:40:D9:10:DC"
    },
    "intermediate_ca": {
      "file": "ca-chain.pem (first cert)",
      "signature_algorithm": "ML-DSA-87 key, signed by SLH-DSA-SHA2-256s root (FIPS 204/205)",
      "subject": "CN=PQ Crypta Intermediate CA 2026, O=PQ Crypta",
      "validity_years": 5,
      "dates": "notBefore=Jul 19 17:18:43 2026 GMT\nnotAfter=Jul 18 17:18:43 2031 GMT",
      "sha256_fingerprint": "7E:91:4F:69:3C:11:CD:0E:F6:02:D9:4A:08:1C:38:65:C3:DA:7F:B9:BE:E9:92:D2:AA:D9:A9:D2:B2:52:14:91"
    },
    "server": {
      "file": "server.crt",
      "signature_algorithm": "ML-DSA-87 key, signed by ML-DSA-87 intermediate (FIPS 204)",
      "subject": "CN=pqc.pqcrypta.com, O=PQ Crypta",
      "san": [
        "DNS:pqc.pqcrypta.com",
        "DNS:www.pqc.pqcrypta.com"
      ],
      "validity_years": 2,
      "dates": "notBefore=Jul 19 17:18:44 2026 GMT\nnotAfter=Jul 18 17:18:44 2028 GMT",
      "sha256_fingerprint": "AE:A4:3B:6C:0E:CD:04:5B:68:9F:D4:39:F1:BB:E6:E6:ED:2F:7A:31:31:38:63:BD:EA:8E:8F:2E:BC:27:D9:25"
    }
  },
  "verification": "OPENSSL_CONF=/dev/null openssl verify -CAfile root-ca.crt -untrusted ca-chain.pem server.crt",
  "notes": {
    "security_levels": "Root: NIST Level 5 (SLH-DSA-SHA2-256s). Intermediate/leaf: NIST Level 5 (ML-DSA-87).",
    "design": "Hash-based root (most conservative PQ assumption) anchoring lattice-based operational certs - the pattern expected for future PQ WebPKI.",
    "browser_support": "No mainstream browser validates ML-DSA/SLH-DSA certificate signatures yet; verify the chain with OpenSSL 3.5+.",
    "previous_chain": "2025 ML-DSA-87 chain (pre-final encoding, expired 2026-01-21) archived as root-ca-2025.crt"
  }
}