How urgency was derived. Findings are ranked with
Mosca's inequality: a data confidentiality horizon of 30 years plus an
assumed 3-year migration
exceeds
the conservative 2035 planning horizon used throughout this report.
Traffic recorded today would therefore still be sensitive by the time it
could be decrypted, so harvest-now-decrypt-later exposure is treated as immediate.
The 2035 figure is a planning assumption drawn from published expert surveys,
not a prediction of a date.
Scope. An external scan observes only your public TLS
perimeter — typically a small fraction of an organisation's cryptographic footprint.
Internal services, data at rest, PKI, HSMs and code-level cryptography are not visible
from the outside and are not assessed here. Roadmap steps that this scan cannot reach
are marked as such below.
Cryptographic inventory — network layer
Extracted from the CycloneDX 1.6 CBOM generated
for this scan. Quantum security level (QSL) follows the CycloneDX convention:
0 means no quantum resistance; 1–5 are NIST security categories.
4 of 8 inventoried assets are at QSL 0.
Your TLS endpoints negotiate only classical key-exchange groups (elliptic-curve / finite-field Diffie-Hellman). Traffic recorded today can be decrypted once these algorithms are broken — the harvest-now-decrypt-later exposure that regulators now expect you to inventory and plan around.
Why this priority: data confidential for 30+ years plus a 3-year migration outlives a conservative 2035 horizon — traffic recorded today would still be sensitive when decrypted.
PCI DSS 4.0.1, requirement 12.3.3 — cipher suites and protocols must be documented and their viability actively tracked — mandatory since 31 March 2025 (in force).
https://www.pcisecuritystandards.org/document_library/
NIST IR 8547 (draft) — draft migration guidance: RSA-2048 and ECC P-256 deprecated after 2030, disallowed after 2035 (draft).
https://csrc.nist.gov/pubs/ir/8547/ipd
DORA (Regulation (EU) 2022/2554, Art. 9(4)(d); RTS (EU) 2024/1774, Arts. 6–7) — in force since 17 January 2025 — requires a documented policy on encryption and cryptographic controls, a register of certificates, and updating cryptography as cryptanalysis develops (RTS Art. 6(4)) (in force).
https://eur-lex.europa.eu/eli/reg/2022/2554/oj
Key exchange without forward secrecymigrate-now
Cipher suites using static RSA or static Diffie-Hellman key exchange are accepted. A single compromised private key retroactively decrypts all recorded sessions — the worst harvest-now-decrypt-later profile an endpoint can have.
Why this priority: data confidential for 30+ years plus a 3-year migration outlives a conservative 2035 horizon — traffic recorded today would still be sensitive when decrypted.
PCI DSS 4.0.1, requirement 12.3.3 — cipher suites and protocols must be documented and their viability actively tracked — mandatory since 31 March 2025 (in force).
https://www.pcisecuritystandards.org/document_library/
DORA (Regulation (EU) 2022/2554, Art. 9(4)(d); RTS (EU) 2024/1774, Arts. 6–7) — in force since 17 January 2025 — requires a documented policy on encryption and cryptographic controls, a register of certificates, and updating cryptography as cryptanalysis develops (RTS Art. 6(4)) (in force).
https://eur-lex.europa.eu/eli/reg/2022/2554/oj
Certificate relies on a quantum-vulnerable signature algorithmtrack
Your certificate chain uses RSA/ECDSA signatures. Public web PKI does not yet issue post-quantum certificates, so this is a crypto-agility roadmap item rather than an immediate fix — but it belongs in your inventory and migration plan.
Why this priority: fixable only together with the ecosystem (public PKI does not issue post-quantum certificates yet) — keep in the inventory and crypto-agility plan.
public key: {"size": 2048, "type": "RSA"}
NIST IR 8547 (draft) — draft migration guidance: RSA-2048 and ECC P-256 deprecated after 2030, disallowed after 2035 (draft).
https://csrc.nist.gov/pubs/ir/8547/ipd
DORA (Regulation (EU) 2022/2554, Art. 9(4)(d); RTS (EU) 2024/1774, Arts. 6–7) — in force since 17 January 2025 — requires a documented policy on encryption and cryptographic controls, a register of certificates, and updating cryptography as cryptanalysis develops (RTS Art. 6(4)) (in force).
https://eur-lex.europa.eu/eli/reg/2022/2554/oj
Legacy TLS protocol versions acceptedhygiene
The server still accepts protocol versions that current standards consider end-of-life. Beyond the direct weaknesses, this signals limited cryptographic agility — the capability regulators increasingly ask you to demonstrate.
protocols: TLS 1.0, TLS 1.1
PCI DSS 4.0.1, requirement 12.3.3 — cipher suites and protocols must be documented and their viability actively tracked — mandatory since 31 March 2025 (in force).
https://www.pcisecuritystandards.org/document_library/
Risk map
Priority
Action window
Findings in this band
Migrate now
start in the current quarter, ahead of the wider programme
No post-quantum key exchange support Key exchange without forward secrecy
Plan
scheduled inside the 36-month roadmap below
none in this scan
Track
keep in the inventory; act when the ecosystem allows it
Certificate relies on a quantum-vulnerable signature algorithm
Hygiene and coverage
routine TLS hygiene and scan coverage — not driven by the quantum timeline
Legacy TLS protocol versions accepted
The map covers what an external scan can see. Bands are assigned by
finding class and by the data horizon above — the same ranking that orders the roadmap.
Migration roadmap — 36 months
A skeleton programme, not a commitment: quarters show the intended
sequence for an institution of your size. Items marked migrate now
start immediately, ahead of the step that formally contains them. Steps with no findings
from this scan are scoped from the internal inventory built in step 1.
Q1Q2Q3Q4Q5Q6Q7Q8Q9Q10Q11Q12
1. Cryptographic inventory (CBOM)
2. Harvest-now-decrypt-later prioritisation
3. Crypto-agility refactor
4. Hybrid TLS and PKI
5. Data at rest through envelope encryption
6. Code and firmware signing
7. Validation and monitoring
1. Cryptographic inventory (CBOM)Q1–Q2
Extend this external snapshot into a full CycloneDX inventory: internal services, PKI, key stores, HSMs, and third-party and SaaS dependencies. Nothing can be migrated before it is listed, and every later step is measured against this artefact.
Closes no finding from this external scan — scoped from the
internal inventory.
2. Harvest-now-decrypt-later prioritisationQ2–Q3
Attach a confidentiality horizon and an applicable regulatory deadline to each inventoried asset, then rank with Mosca's inequality. Long-horizon data on externally reachable paths is scheduled first.
Closes no finding from this external scan — scoped from the
internal inventory.
3. Crypto-agility refactorQ3–Q5
Introduce a cryptographic provider interface and an algorithm registry, and remove hard-coded algorithm identifiers, OIDs and fixed-size key and signature fields. Done before deployment, each later algorithm change becomes a configuration change rather than a capital project.
migrate-now
No post-quantum key exchange support
4. Hybrid TLS and PKIQ4–Q7
Enable hybrid TLS 1.3 key exchange on external endpoints and internal mTLS, set a policy floor of “no weaker than hybrid”, and retire key exchange without forward secrecy along with end-of-life protocol versions. Certificate work follows the pace of the public PKI and of your HSM firmware.
migrate-now
No post-quantum key exchange support
migrate-now
Key exchange without forward secrecy
track
Certificate relies on a quantum-vulnerable signature algorithm
hygiene
Legacy TLS protocol versions accepted
5. Data at rest through envelope encryptionQ7–Q9
Data-encryption keys stay AES-256 — symmetric cryptography is not the exposure. Re-wrap the key-encryption keys with a hybrid key-encapsulation mechanism so re-keying stays cheap and repeatable, instead of re-encrypting bulk storage.
Closes no finding from this external scan — scoped from the
internal inventory.
6. Code and firmware signingQ9–Q11
Signing keys outlive the artefacts they sign. Move release and firmware signing to hash-based signatures (LMS/XMSS) now, with SLH-DSA or ML-DSA for the longest-lived roots of trust.
Closes no finding from this external scan — scoped from the
internal inventory.
7. Validation and monitoringQ11–Q12
Interoperability and load testing of the heavier handshakes, downgrade detection, and reconciliation of the running estate against the CBOM. The inventory becomes a living artefact instead of a one-off document.
Closes no finding from this external scan — scoped from the
internal inventory.
Method
Protocol, cipher-suite, key-exchange-group and certificate data collected with
sslyze 6.3.1 and cross-checked with testssl.sh.
Post-quantum support probed with a live TLS 1.3 handshake restricted to the
hybrid X25519MLKEM768 group (OpenSSL 3.6.2 7 Apr 2026).
The observed assets are recorded as a CycloneDX 1.6 CBOM whose
serial number is derived from the domain and scan timestamp, so the same scan always
produces the same inventory. Assets marked QSL 0 follow the CycloneDX
nistQuantumSecurityLevel convention. Priorities come from Mosca's inequality with the
parameters stated in the summary. Regulatory references follow the Kybermark mandate
register v2026-09-02; each reference carries its source and status, and
drafts are labelled as drafts.
This report was generated from input data with SHA-256
21f042ae770a062580ce6cd69b0f0dd7e3fa6b85f32666a648ba10cc0ff058be; the client-retained copy of the scan
output carries the same hash.
Limits worth stating plainly: the date of a cryptanalytically relevant quantum computer
is a probability distribution, not a date, and 2035 is the conservative end of
published expert surveys. Hybrid TLS key exchange is stable and widely deployed; hybrid
X.509 certificates are still Internet-Drafts, which is why certificate findings are
ranked as items to track rather than to fix today.