Post-Quantum Certificates (PQC)

QROS generates and validates real NIST post-quantum certificates using the oqs-provider (Open Quantum Safe). The first NIST PQC standards are ready: FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). QROS supports all of them, plus hybrid classical+PQC composites — the quantum-safe foundation of your PKI, with a CA hierarchy and real CRL revocation.

QROS · Generate · certificatePQC ✓

Subject

CN=app.banco.com · O=Banco SA

ML-DSA-65Ed25519ECDSA P-256RSA-3072

p256_mldsa44 hybridSLH-DSAFalcon-512

Validation (8 checks)

✓ Key length ≥ 256-bit eq

✓ Modern curve

✓ SHA-2/3 signature

✓ SAN present

✓ Validity ≤ 398d

✓ CA:FALSE / EKU

✓ Must-staple

✓ Shor-resistant

passesAllTests = true

QROS · CA hierarchy + CRL

CA-signed revocation served at /ca/{fingerprint}/crl; integrated chain verification in real time.

Supported post-quantum algorithms

ML-DSA-44 (FIPS 204, equivalent to AES-128 security) — NIST's primary lattice-based signature
ML-DSA-65 (FIPS 204, equivalent to AES-192 security)
ML-DSA-87 (FIPS 204, equivalent to AES-256 security)
SLH-DSA-SHA2-128s/192s/256s (FIPS 205) — stateless hash-based signatures
Falcon-512/1024 (FIPS 206 draft) — compact lattice signatures
Hybrid composites — p256_mldsa44, p384_mldsa65, p521_mldsa87, rsa3072_mldsa44

What QROS generates

Self-signed TLS leaf certificates (standalone mode)
Root CA certificates (CA:TRUE, keyCertSign + cRLSign)
Issued certificates signed by a parent CA (leaf or intermediate)
CSRs (Certificate Signing Requests)
Verifiable document signatures (W3C VC with PQC proof)
Self-validation checklist + PEMs (cert/key/fullchain/CSR)

What a PQC certificate looks like in QROS

When you generate a post-quantum certificate with QROS, the result includes the algorithm, key type, and a self-validation checklist:

Post-Quantum Certificate

Quantum-safe ✓

Algorithm: ML-DSA-44

Standard: FIPS 204

Key type: Lattice-based

Security: NIST Level 1 (AES-128)

Type: Self-signed leaf

CN: example.com

Validation checklist

✓ Certificate signature verified (ML-DSA-44 via oqs-provider)

✓ Key is post-quantum resistant (Shor's algorithm cannot break it)

✓ Certificate is X.509 compliant

✓ PEM output: cert.pem, key.pem, fullchain.pem, csr.pem

Learn about quantum readiness →

FAQ

What PQC algorithms does QROS support?

QROS supports ML-DSA-44/65/87 (FIPS 204), SLH-DSA-SHA2-128s/192s/256s (FIPS 205), Falcon-512/1024 (FIPS 206 draft), and hybrid composites (p256_mldsa44, p384_mldsa65, p521_mldsa87, rsa3072_mldsa44).

Can QROS generate hybrid classical+PQC certificates?

Yes. QROS generates hybrid composites like p256_mldsa44 (ECDSA P-256 + ML-DSA-44), p384_mldsa65, p521_mldsa87, and rsa3072_mldsa44. These provide both classical and post-quantum security in a single certificate.

Try this service with QROS

Explore now →