PQC transition coordination for shared services

Post-quantum migration of a shared service needs every party in the chain: your own organisation, suppliers, counterparties, certificate authorities and network providers. Pick a reference service and, if you wish, the product release of each component to see what the reviewed evidence says, what blocks what, who must act and a shared action plan you can print or export.

A product that supports a post-quantum algorithm does not mean the service can migrate: every party must configure, test and agree it, and the fallback must be retired. The reference services are illustrative templates, not real estates, not an agreed plan and not a coordination body. Not compliance advice.

Choose a reference service

Reference services

Public website over TLS behind a CDN and a load balancer, with an HSM-backed certificate authority
Visitors connect to a CDN edge, which forwards requests through the organisation's load balancer to its origin servers. Certificates come from a certificate authority whose signing keys sit in a hardware security module. Key establishment and certificate signatures migrate separately.
Site-to-site IPsec VPN (IKEv2) between two organisations
Two organisations connect their networks with an IKEv2 tunnel between one gateway each, authenticated with certificates, over a transit network run by a provider. Neither organisation can migrate the tunnel alone.
SSH administration of servers, partly by an outsourced operator
Administrators of the organisation and of an outsourced operator reach managed servers through a bastion host run by the operator. Each SSH hop negotiates its own key exchange.
Code signing and firmware updates from a supplier to an operator's devices
A device supplier signs firmware and software updates with keys held in an HSM; devices in the operator's network verify the signature before installing. Devices must be able to verify new signatures before the signer can switch.
Qualified electronic signatures and seals with a qualified trust service provider
An organisation signs documents with qualified certificates from a qualified trust service provider, whose keys sit in a qualified signature creation device; recipients validate the signatures with their own software against the EU trusted lists.

PQC product navigator: readiness evidence by product release · PQC guide: what the rules say · PQC milestones and deadlines · EU legal acts on quantum · Document library

Illustrative reference services for coordinating a post-quantum migration across organisations (#471, first pilot). Each service is a generic chain of components with the role that controls each one; product readiness comes only from the editor-approved assertions of the PQC product navigator, never from this file. Requirement and interoperability sources were read on 23 October 2026 on the publishers' own pages; summaries are the portal's own words. Not a coordination body, not an agreed plan, not compliance advice. Reference services compiled 2026-10-23.