Red Hat Certificate System 11 brings post-quantum algorithms into enterprise PKI

Red Hat Certificate System 11 now supports the standardized post-quantum algorithms ML-DSA for digital signatures and ML-KEM for key encapsulation. The change puts quantum-resistant certificate issuance and lifecycle management into Red Hat’s Dogtag-based enterprise public-key infrastructure rather than leaving it as an application-by-application experiment.

What changed

Red Hat says Certificate System 11 can issue, manage and revoke X.509 post-quantum certificates across hybrid-cloud environments. It integrates with RHEL Global Cryptographic Policies, allowing administrators to change the operating system’s cryptographic posture centrally instead of reconfiguring each application separately.

The product supports automated enrollment through EST and ACME and provides certificate-authority, key-recovery and Online Certificate Status Protocol services. Red Hat positions those existing lifecycle functions as important for post-quantum adoption because larger keys, transitional dual signatures and shorter certificate lifetimes can multiply renewal work.

The company also points to an Ansible Automation Platform discovery workflow for finding legacy certificates and other cryptographic attributes across a fleet. That creates a two-stage migration path: inventory classical cryptography first, then use Certificate System as the trust anchor for replacement credentials.

Who should care

The immediate audience is platform-security and PKI teams responsible for long-lived sensitive data, regulated systems or large hybrid estates. Developers are affected indirectly: moving algorithm policy and certificate rotation into shared infrastructure can reduce the number of cryptographic decisions embedded in individual applications.

The release does not make every application post-quantum-safe by itself. Protocol compatibility, certificate-chain size, hardware security modules, clients and network devices still need testing. A certificate authority that can issue ML-DSA or use ML-KEM is one dependency in a migration, not the whole migration.

What to do

Teams should begin with an inventory of certificates, algorithms, expiration periods and application dependencies. They should identify systems that must retain confidentiality for many years and test hybrid or post-quantum chains in representative environments before changing fleet-wide policy.

Certificate System 11’s RHEL policy integration and automated enrollment are the operational features to validate first. Administrators should measure handshake and payload changes, confirm client support, and rehearse rollback. Red Hat’s announcement establishes product capability, but each organization still needs a staged interoperability plan before replacing classical public-key cryptography in production.