PKI CBOM Profile, v0.1 draft

Post-quantum readiness for PKI, certificates and code signing

A free, open CycloneDX 1.7 community profile for certificate authorities, enterprise PKI and signing infrastructure.

For: PKI architects, IAM and SecOps leads, certificate-lifecycle owners

Download the profile (CycloneDX 1.7)Measure your own exposure (free)

v0.1 draft, updated 7 Oct 2026. Validated against the CycloneDX 1.7 schema. A starting point, not a compliance determination.

Why now

  • NIST FIPS 203, 204 and 205 (Aug 2024). Standardised ML-KEM, ML-DSA and SLH-DSA, the target algorithms for migration.
  • CA/Browser Forum ballot SC-081. Public TLS certificate lifetimes fall in stages to 47 days by March 2029, making automation essential.
  • NSA CNSA 2.0. Quantum-resistant algorithm suite and timelines for US national security systems.
  • US Executive Order 14412. Post-quantum signatures for federal high-value systems by end-2031.

A practical migration path

  1. Inventory every CA, certificate and signing key with its algorithm and expiry
  2. Automate certificate lifecycle ahead of shorter lifetimes
  3. Test hybrid and post-quantum certificates in a lab
  4. Plan root and issuing CA transitions
  5. Document crypto-agility for auditors

From profile to evidence

Learn the risk in OpenRiskLab, build and keep your own CBOM in QDayRisk, and certify readiness in the public PQReady registry.

Contribute or stay informed

This profile will be updated to the CISA and NIST CBOM minimum elements when they are published. Practitioners, vendors and standards bodies are invited to co-author it under an open licence, with credit. How contributions work.

Notify me of updatesContribute