{
    "status": "pilot",
    "generated": "2026-11-03",
    "disclaimer": "Illustrative reference service. Readiness comes only from editor-approved PQC navigator assertions; a product that supports an algorithm does not mean the service can migrate. Dates are unknown unless published; nothing here is agreed between parties. Not compliance advice.",
    "service": {
        "id": "tls-website-cdn",
        "title": "Public website over TLS behind a CDN and a load balancer, with an HSM-backed certificate authority",
        "illustrative": true,
        "summary": "Visitors connect to a CDN edge, which forwards requests through the organisation's load balancer to its origin servers. Certificates come from a certificate authority whose signing keys sit in a hardware security module. Key establishment and certificate signatures migrate separately.",
        "limitations": "A generic template, not a real estate. Each TLS hop is negotiated separately: a protected visitor connection says nothing about the edge-to-origin hop. Publicly trusted certificates cannot use post-quantum signatures under the current CA/Browser Forum rules.",
        "compiled": "2026-10-23"
    },
    "components": [
        {
            "id": "visitor-browsers",
            "label": "Visitors' browsers and devices",
            "controlled_by": "Counterparty (the other organisation or its users)",
            "function": "TLS key establishment",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "cdn-edge",
            "label": "CDN edge: TLS towards visitors and towards the origin",
            "controlled_by": "Network, CDN or hosting provider",
            "function": "TLS key establishment",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "visitor-browsers"
            ],
            "blocked_by": [
                "visitor-browsers"
            ]
        },
        {
            "id": "load-balancer",
            "label": "Load balancer terminating TLS in front of the origin",
            "controlled_by": "Own organisation",
            "function": "TLS key establishment",
            "chosen_release": null,
            "readiness": "Not covered by the product navigator",
            "assertion": null,
            "depends_on": [
                "cdn-edge"
            ],
            "blocked_by": [
                "cdn-edge",
                "visitor-browsers"
            ]
        },
        {
            "id": "origin-tls",
            "label": "Origin web servers and their TLS library",
            "controlled_by": "Own organisation",
            "function": "TLS key establishment",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "load-balancer"
            ],
            "blocked_by": [
                "load-balancer",
                "cdn-edge",
                "visitor-browsers"
            ]
        },
        {
            "id": "ca-hsm",
            "label": "HSM holding the certificate authority's signing keys",
            "controlled_by": "Certificate authority or trust service provider",
            "function": "HSM key storage and operations",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "certificate-authority",
            "label": "Certificate authority issuing the server certificates",
            "controlled_by": "Certificate authority or trust service provider",
            "function": "PKI / CA certificate issuance",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "ca-hsm"
            ],
            "blocked_by": [
                "ca-hsm"
            ]
        },
        {
            "id": "edge-certificates",
            "label": "Certificates the CDN edge presents to visitors",
            "controlled_by": "Network, CDN or hosting provider",
            "function": "Certificate signatures",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "certificate-authority",
                "visitor-browsers"
            ],
            "blocked_by": [
                "certificate-authority",
                "visitor-browsers",
                "ca-hsm"
            ]
        }
    ],
    "plan": [
        {
            "party": "counterparty",
            "party_label": "Counterparty (the other organisation or its users)",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "visitor-browsers",
            "component_label": "Visitors' browsers and devices",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Visitors' browsers and devices and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "network-provider",
            "party_label": "Network, CDN or hosting provider",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "cdn-edge",
            "component_label": "CDN edge: TLS towards visitors and towards the origin",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for CDN edge: TLS towards visitors and towards the origin and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-visitor-browsers"
            ],
            "waits_for_labels": [
                "Visitors' browsers and devices"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "own-organisation",
            "party_label": "Own organisation",
            "step": "statements",
            "step_label": "Supplier and counterparty statements obtained",
            "component": "load-balancer",
            "component_label": "Load balancer terminating TLS in front of the origin",
            "readiness": "Not covered by the product navigator",
            "action": "Obtain a dated statement on post-quantum support for Load balancer terminating TLS in front of the origin; the product navigator has no record for it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-cdn-edge"
            ],
            "waits_for_labels": [
                "CDN edge: TLS towards visitors and towards the origin"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "own-organisation",
            "party_label": "Own organisation",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "origin-tls",
            "component_label": "Origin web servers and their TLS library",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Origin web servers and their TLS library and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-load-balancer"
            ],
            "waits_for_labels": [
                "Load balancer terminating TLS in front of the origin"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "ca-trust-service",
            "party_label": "Certificate authority or trust service provider",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "ca-hsm",
            "component_label": "HSM holding the certificate authority's signing keys",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for HSM holding the certificate authority's signing keys and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "ca-trust-service",
            "party_label": "Certificate authority or trust service provider",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "certificate-authority",
            "component_label": "Certificate authority issuing the server certificates",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Certificate authority issuing the server certificates and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-ca-hsm"
            ],
            "waits_for_labels": [
                "HSM holding the certificate authority's signing keys"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "network-provider",
            "party_label": "Network, CDN or hosting provider",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "edge-certificates",
            "component_label": "Certificates the CDN edge presents to visitors",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Certificates the CDN edge presents to visitors and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-certificate-authority",
                "c-visitor-browsers"
            ],
            "waits_for_labels": [
                "Certificate authority issuing the server certificates",
                "Visitors' browsers and devices"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "interop-test",
            "step_label": "Interoperability test",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Run a joint interoperability test of the whole chain in a test environment and record its scope and result.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-visitor-browsers",
                "c-cdn-edge",
                "c-load-balancer",
                "c-origin-tls",
                "c-ca-hsm",
                "c-certificate-authority",
                "c-edge-certificates"
            ],
            "waits_for_labels": [
                "Visitors' browsers and devices",
                "CDN edge: TLS towards visitors and towards the origin",
                "Load balancer terminating TLS in front of the origin",
                "Origin web servers and their TLS library",
                "HSM holding the certificate authority's signing keys",
                "Certificate authority issuing the server certificates",
                "Certificates the CDN edge presents to visitors"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "pilot",
            "step_label": "Pilot",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Pilot the service with a limited group, keeping the classical fallback.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-interop-test"
            ],
            "waits_for_labels": [
                "Interoperability test"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "rollout",
            "step_label": "Staged rollout",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Roll out in stages agreed by every party.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-pilot"
            ],
            "waits_for_labels": [
                "Pilot"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "validation",
            "step_label": "Validation",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Validate that the post-quantum mechanisms are actually negotiated or verified on every hop.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-rollout"
            ],
            "waits_for_labels": [
                "Staged rollout"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "retire-legacy",
            "step_label": "Retirement of the legacy fallback, when authorised",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Retire the classical-only fallback only when every party has authorised it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-validation"
            ],
            "waits_for_labels": [
                "Validation"
            ],
            "date": "Unknown: no date published or agreed"
        }
    ],
    "milestones": [
        {
            "id": "eu-pqc-milestone-2026",
            "date": "2026-12-31",
            "date_text": "By 31 December 2026",
            "title": "EU roadmap milestone 1: first steps and national roadmaps",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        },
        {
            "id": "eu-pqc-milestone-2030",
            "date": "2030-12-31",
            "date_text": "By 31 December 2030",
            "title": "EU roadmap milestone 2: high-risk use cases migrated",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        },
        {
            "id": "joint-statement-18-member-states",
            "date": "2024-11-27",
            "date_text": null,
            "title": "Joint statement of national agencies: protect the most sensitive use cases by 2030",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        }
    ],
    "interop": [
        {
            "id": "hackathon-ml-dsa-65-certificates",
            "title": "IETF PQC Hackathon: ML-DSA-65 X.509 certificate artifacts",
            "result": "Passed within the stated scope",
            "scope": "Parsing and verifying self-signed ML-DSA-65 certificate artifacts from 17 producers with 4 verifiers (Bouncy Castle, a composite reference implementation, OpenSSL and QUBIP Aurora): all 68 pairs passed.",
            "limitations": "Artifact test, not a TLS handshake or a deployed service. The page names submitters, not product releases or builds, so it does not apply to a particular release listed here. Not a certification.",
            "url": "https://ietf-hackathon.github.io/pqc-certificates/pqc_hackathon_results_certs_r5_automated_tests.html",
            "results_date": "2026-10-06",
            "retrieved": "2026-10-23"
        },
        {
            "id": "hackathon-ml-dsa-65-private-keys",
            "title": "IETF PQC Hackathon: ML-DSA-65 private key formats",
            "result": "Failed within the stated scope",
            "scope": "Reading ML-DSA-65 private key files with the OpenSSL parser: seed-format keys from 10 producers were accepted and those from 2 producers, Botan and one other submitter, were rejected; the same 2 failed the seed and expanded-key consistency check.",
            "limitations": "The results page does not state why the files were rejected; the run logs are linked from the project index. Applies to the submitted artifacts only, not to a product release, and says nothing about certificates or signatures.",
            "url": "https://ietf-hackathon.github.io/pqc-certificates/pqc_hackathon_results_certs_r5_automated_tests.html",
            "results_date": "2026-10-06",
            "retrieved": "2026-10-23"
        }
    ]
}