Topic starter
24/06/2026 6:57 pm
TL;DR: Core post-quantum infrastructure migration will finish by 2029, with TLS and certificate systems moving in stages to avoid breaking existing customers while reducing harvest-now, decrypt-later exposure, according to DigiCert. The shift shows that cryptographic agility and certificate lifecycle governance are now identity security priorities, not future research.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “DigiCert’s 2029 post-quantum infrastructure migration plan”.
Key questions
Q: How should IAM and infrastructure teams prioritise post-quantum migration?
A: Prioritise internet-facing assets, then move to the cryptographic assets with the longest replacement lead times and the weakest inventory.
Q: Why does post-quantum migration matter for identity governance?
A: Because identity governance does not stop at user access.
Q: What breaks when classical key exchange stays in place too long?
A: Harvest-now, decrypt-later risk remains active, and the organisation keeps protecting sensitive traffic with trust assumptions that are already on borrowed time.
Practitioner guidance
- Inventory certificate and TLS dependencies Map all internal and external TLS endpoints, certificate chains, termination services, and legacy client dependencies before changing crypto policy.
- Classify systems by migration readiness Separate browser-supported paths, modern libraries, embedded systems, and long-lived platforms so sequencing reflects actual compatibility constraints.
- Automate certificate issuance and lifecycle workflows Extend PKI automation to cover issuance, renewal, algorithm transition, and retirement so PQC certificates do not create manual bottlenecks.
Bottom line: Post-quantum migration is now a certificate governance issue because identity systems depend on the same lifecycle controls that manage trust at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:00 am
Certificate lifecycle governance is now a post-quantum identity control, not a peripheral PKI task. The article shows that PQC migration spans issuance, automation, dependency inventory, and retirement of legacy trust paths. That means certificate governance now sits inside the same operational discipline as NHI lifecycle management, where ownership, rotation, and offboarding determine exposure. Practitioners should treat cryptographic agility as a governance capability, not a one-time migration project.
A question worth separating out:
Q: Should organisations use hybrid post-quantum deployments during migration?
A: Yes, if hybrid support is the bridge that preserves service continuity, but it should not become the destination. Hybrid deployments can reduce disruption during transition, yet they still leave the organisation managing two trust models at once, which raises lifecycle complexity.
👉 Read our full editorial: Post-quantum certificate migration is now an identity governance issue