CNSA 2.0 Implementation Guide with OpenSSL: How to Build a Quantum-Resistant Certificate Authority

Are your certificates quantum-ready?

Hey, remember when we wrote an article series on building a CA for NSA Suite B? Yeah, that was fun, so we did it again for the Commercial National Security Algorithm Suite (CNSA) 2.0 for a quantum-resistant Certificate Authority. The below GitHub lab guide teaches you how to "quickly" build a post-quantum Certificate Authority (CA) using OpenSSL 3.2+ with Open Quantum Safe (OQS) libraries and ML-DSA algorithms at level 4 and 5 strengths, the current quantum-safe cryptography approved for CNSA 2.0 and FIPS 204/205.

Why implement post-quantum cryptography (PQC) now?

Organizations like yours face a challenge: mean people are extracting encrypted data to decrypt when quantum computers become available, a threat called "harvest now, decrypt later." We want to help you close your quantum cryptography knowledge gap, so you can get secured sooner and limit potential problems that might not surface until later. Ignorance is not bliss when it comes to cryptography and regulatory fines, so let's get started. The GitHub lab provides step-by-step instructions to create:

• Quantum-resistant Root CA with 10-year validity using ML-DSA-87 (Dilithium5)
• Post-quantum Intermediate CA using ML-DSA-65 (Dilithium3)
• Quantum-safe server and client certificates
• OCSP and CRL revocation for quantum-resistant certificates

Access the Complete Lab Guide on GitHub →

At a Glance: Openssl Quantum-Resistant CA Lab

What This Lab Guide Achieves

Complete PKI Hierarchy Implementation

The lab walks through building a production-ready PKI infrastructure from scratch, including:

• Root Certificate Authority: A 10-year Root CA using ML-DSA-87 (formerly Dilithium5), providing the highest CNSA 2.0 security level
• Intermediate Certificate Authority: A 5-year Intermediate CA using ML-DSA-65 (formerly Dilithium3) for operational certificate issuance
• End-Entity Certificates: Server and user certificates with comprehensive Subject Alternative Names (SANs) for real-world applications
• Revocation Infrastructure: Both Certificate Revocation Lists (CRL) and Online Certificate Status Protocol (OCSP) implementation
• Security Best Practices: Proper Unix file permissions, secure key storage, and backup procedures throughout

CNSA 2.0 Compliance

Every component strictly adheres to the NSA’s quantum-resistant algorithm requirements:

• ML-DSA-65 and ML-DSA-87 for digital signatures
• SHA-512 for cryptographic hashing
• Proper certificate extensions and validation paths
• RFC 5280 compliance for X.509 certificates

Key Takeaways

After completing this 4-5 hour lab, you will:

1. Understand Quantum Threats: Grasp why current RSA/ECDSA cryptography is vulnerable and how quantum-resistant algorithms provide protection
2. Master ML-DSA Cryptography: Gain hands-on experience with both ML-DSA-65 (Level 3 security) and ML-DSA-87 (Level 5 security) algorithms
3. Build Production-Ready Infrastructure: Create a complete PKI hierarchy that could serve as a template for organizational deployment
4. Implement Comprehensive Security: Apply proper file permissions, secure key storage, and backup procedures throughout the infrastructure
5. Configure Modern PKI Features: Implement SANs with DNS, IP, email, and URI entries, plus both CRL and OCSP revocation mechanisms
6. Troubleshoot Effectively: Learn to diagnose and resolve common issues with quantum-resistant certificates
7. Prepare for Migration: Understand the practical steps needed to transition existing PKI infrastructure to quantum-resistant algorithms

Who Should Read This Guide

• Enterprise Security Teams migrating from RSA to quantum-resistant algorithms
• Government Contractors requiring CNSA 2.0 compliance for classified systems
• Financial Institutions protecting long-term transaction records from quantum threats
• Healthcare Organizations securing patient data with regulatory requirements
• Cloud Service Providers implementing quantum-safe infrastructure for customers
• PKI Consultants preparing for post-quantum migration projects
• DevOps Engineers building quantum-ready CI/CD certificate pipelines
• Nerds wanting to drop sweet lyrics at your local watering hole

Reference Links

1. NIST Post-Quantum Cryptography Standards - Official NIST PQC project page with FIPS 204 (ML-DSA) specifications
2. NSA CNSA 2.0 Algorithm Requirements - NSA's official CNSA 2.0 announcement and requirements
3. Open Quantum Safe Project - Home of the OQS provider enabling quantum-resistant algorithms in OpenSSL
4. OQS Provider for OpenSSL 3 - GitHub repository for the OQS provider with installation instructions
5. RFC 5280: Internet X.509 PKI - Essential standard for X.509 certificate and CRL profiles
6. OpenSSL 3.0 Documentation - Comprehensive OpenSSL documentation for understanding commands and options
7. FIPS 204: ML-DSA Standard - The official Module-Lattice-Based Digital Signature Standard

Access the Complete Lab Guide on GitHub →

About This Guide

We built the first guide for building a lab CA for NSA Suite B because guides we relied on lost relevance with ECC and modern cipher requirements. This lab is the evolution of that need. By putting it on GitHub, other PKI fans can help where I may have missed something; or simply to expand on it with additional modules or forks. In the spirit of Learn Python the Hard Way, it focuses on manual repetition, hands-on interactions and real-world scenarios. It provides the practical experiences needed to implement quantum-resistant PKI in production environments.

Frequently Asked Questions (FAQS)