The authoritative source index for the DevCentral Publishing State of PKI Pocket Guide
This index provides direct, one-click access to the standards, government directives, IETF drafts, and postmortem case studies referenced across all chapters in the DevCentral Publication available through your sales engineer, solution architect, or at your favorite F5 conference. Please contact the article author for availability outside of standard events.
- CA/Browser Forum. Ballot SC-081v3 (validity/reuse schedule), Apr 2025.
Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods | CA/Browser Forum - Sectigo. 200-day SSL/TLS validity risk explainer.
Certificate Expiration Risk: 200 Day Validity Starts March 15 | Sectigo® Official - Let’s Encrypt. Decreasing Certificate Lifetimes to 45 Days, staged to Feb 2028.
Decreasing Certificate Lifetimes to 45 Days - Let's Encrypt - DigiCert. TLS Certificate Lifetimes Reduce to 47 Days.
TLS Certificate Lifetimes Will Officially Reduce to 47 Days | DigiCert - CA/Browser Forum. Ballot SC-067v3, multi-perspective issuance corroboration.
Ballot SC067v3: Require domain validation and CAA checks to be performed from multiple Network Perspectives Corroboration | CA/Browser Forum - CA/Browser Forum. Ballot SC-085v2, DNSSEC validation for CAA/DCV.
Ballot SC-085v2: Require Validation of DNSSEC (when present) for CAA and DCV Lookups | CA/Browser Forum - CA/Browser Forum. Ballot SC-088v3, DNS TXT persistent-value DCV.
Ballot SC-088v3: DNS TXT Record with Persistent Value DCV Method | CA/Browser Forum - IETF draft-ietf-acme-dns-persist. dns-persist-01 ACME challenge.
draft-ietf-acme-dns-persist-02 - Automated Certificate Management Environment (ACME) Challenge for Persistent DNS TXT Record Validation - Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, 22 Jun 2026.
Securing the Nation Against Advanced Cryptographic Attacks – The White House - EU NIS Cooperation Group. Coordinated PQC Implementation Roadmap, Jun 2025.
A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography | Shaping Europe’s digital future - Australian Signals Directorate. Managing cryptographic keys and secrets (ISM guidance).
https://www.cyber.gov.au/business-government/secure-design/secure-by-design/managing-cryptographic-keys-and-secrets - Australian Signals Directorate. Planning for post-quantum cryptography, Sep 2025. Hybrid stance and the end-2030 date.
https://www.cyber.gov.au/sites/default/files/2025-09/Planning%20for%20post-quantum%20cryptography%20(September%202025).pdf - NIST CMVP. Program overview.
Cryptographic Module Validation Program | CSRC - NIST CMVP. FIPS 140-3 Transition Effort.
FIPS 140-3 Transition Effort | CSRC - NIST CMVP. Hawes, CMVP Status and Future Plans, 21 Jan 2026.
https://csrc.nist.gov/csrc/media/presentations/2026/cmvp-status-and-future-plans/images-media/1.4-cmvp_status-hawes.pdf - CycloneDX (OWASP). Cryptography Bill of Materials (CBOM).
Cryptography Bill of Materials (CBOM) | CycloneDX - National Security Memorandum 10 (NSM-10), May 2022.
National Security Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems | The White House - OMB Memorandum M-23-02, Migrating to Post-Quantum Cryptography.
https://www.whitehouse.gov/wp-content/uploads/2022/11/M-23-02-M-Memo-on-Migrating-to-Post-Quantum-Cryptography.pdf - NIST IR 8547 (initial public draft). Transition to PQC Standards.
IR 8547, Transition to Post-Quantum Cryptography Standards | CSRC - NIST NCCoE SP 1800-38 (preliminary draft). Migration to Post-Quantum Cryptography.
SP 1800-38, Migration to Post-Quantum Cryptography: Preparation for Considering the Implementation and Adoption of Quantum Safe Cryptography | CSRC - F5, Inc. Certifications – FIPS 140-3 section.
Certifications | F5 - F5, Inc. FIPS 140-3 Security Policy, Cryptographic Module for BIG-IP, Cert #5487. Active, sunsets 20 Nov 2029.
https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp5487.pdf - F5 TechDocs. Platform FIPS Overview (BIG-IP 17.1).
Platform FIPS Overview | BIG-IP Documentation - F5 TechDocs. BIG-IP 17.1.0 release notes supplement.
BIG-IP 17.1.0 Fixes and Known Issues | BIG-IP Documentation - IETF RFC 8555. ACME.
RFC 8555: Automatic Certificate Management Environment (ACME) | RFC Editor - IETF RFC 9773. ACME Renewal Information (ARI).
RFC 9773 - ACME Renewal Information (ARI) Extension - IETF draft-ietf-acme-device-attest-10 (RFC Editor queue, Aug 2026). Hardware-attested enrollment.
draft-ietf-acme-device-attest-10 - Automatic Certificate Management Environment (ACME) Device Attestation Extension - IETF RFC 7030. EST.
RFC 7030: Enrollment over Secure Transport | RFC Editor - IETF RFC 9810. CMP, obsoletes RFC 4210. RFC 9811 carries the HTTP transfer.
RFC 9810: Internet X.509 Public Key Infrastructure -- Certificate Management Protocol (CMP) | RFC Editor - IETF RFC 9483. Lightweight CMP Profile.
RFC 9483 - Lightweight Certificate Management Protocol (CMP) Profile - IETF RFC 8894. SCEP.
RFC 8894 - Simple Certificate Enrolment Protocol - Let’s Encrypt. FAQ – DV only, no OV/EV by design.
FAQ - Let's Encrypt - Regulation (EU) 2024/1183, consolidated eIDAS text.
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02014R0910-20241018 - NIST FIPS 203. ML-KEM.
FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard | CSRC - NIST FIPS 204. ML-DSA.
FIPS 204, Module-Lattice-Based Digital Signature Standard | CSRC - NIST FIPS 205. SLH-DSA.
FIPS 205, Stateless Hash-Based Digital Signature Standard | CSRC - NSA. CNSA 2.0 FAQ, v2.1, Dec 2024. Current algorithm table and transition dates.
https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF - Regulation (EU) 2022/2554. DORA.
https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng - Directive (EU) 2022/2555. NIS2.
https://eur-lex.europa.eu/eli/dir/2022/2555/2022-12-27/eng - CCCS. ITSM.40.001, PQC migration guidance (Canada).
https://www.cyber.gc.ca/sites/default/files/itsm.40.001-migration-post-quantum-cryptography-government-canada-e.pdf - BSI. TR-02102-1, v2026-01.
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.html - ANSSI. Post-Quantum Transition position paper.
https://messervices.cyber.gouv.fr/documents-guides/follow_up_position_paper_on_post_quantum_cryptography.pdf - KpqC. Final algorithm selections, Jan 2025.
양자내성암호연구단 - China NICCS. National PQC standardization call.
Notice - Institute of Commercial Cryptography Standards - CRYPTREC (Japan). Cryptographic technique guidance.
CRYPTREC | Specifications of CRYPTREC Ciphers List - ECCG/ENISA. Agreed Cryptographic Mechanisms, v3 draft.
EUCC Guidelines on Cryptography - European Union Cybersecurity Certification - ISO/IEC 18033-2:2006/Amd 2:2026. FrodoKEM standardized.
https://cdn.standards.iteh.ai/sist-preview/iso/iso-iec-18033-2-2006-amd-2-2026/65a3b17826904a53bceee9566c9d72ee/iso-iec-18033-2-2006-amd-2-2026.pdf - IETF draft-ietf-tls-mlkem. Pure ML-KEM for TLS 1.3, still a draft.
draft-ietf-tls-mlkem-11 - ML-KEM Post-Quantum Key Agreement for TLS 1.3 - IETF draft-ietf-ipsecme-hybrid-kem-ikev2-frodo.
draft-ietf-ipsecme-hybrid-kem-ikev2-frodo-03 - Post-quantum Key Exchange in IKEv2 with FrodoKEM - IETF draft-smyslov-lamps-frodokem-certificates.
draft-smyslov-lamps-frodokem-certificates-03 - Internet X.509 Public Key Infrastructure - Algorithm Identifiers for FrodoKEM - Open Quantum Safe project. liboqs / oqs-provider.
https://openquantumsafe.org/ - OpenSSL Project. 3.5 series release notes.
https://openssl-library.org/news/openssl-3.5-notes/ - OpenSSH. Post-quantum cryptography in OpenSSH.
https://www.openssh.org/pq.html - NIST SP 800-90A Rev.1. DRBGs (with companion 800-90B/C).
https://csrc.nist.gov/pubs/sp/800/90/a/r1/final - IETF draft-ietf-plants-merkle-tree-certs. Merkle Tree Certificates.
https://datatracker.ietf.org/doc/draft-ietf-plants-merkle-tree-certs/ - IETF draft-davidben-tls-merkle-tree-certs. Predecessor draft.
https://datatracker.ietf.org/doc/draft-davidben-tls-merkle-tree-certs/ - IETF draft-ietf-tls-trust-anchor-ids. Trust anchor negotiation.
https://datatracker.ietf.org/doc/draft-ietf-tls-trust-anchor-ids/ - Let’s Encrypt. OCSP Service Has Reached End of Life, 6 Aug 2025.
https://letsencrypt.org/2025/08/06/ocsp-service-has-reached-end-of-life - Let’s Encrypt. Ending OCSP Support in 2025, 5 Dec 2024.
https://letsencrypt.org/2024/12/05/ending-ocsp - Kerckhoffs’s principle, 1883 – an algorithm’s secrecy should never be the thing protecting you.
https://en.wikipedia.org/wiki/Kerckhoffs’s_principle - IETF RFC 10024. PQ/T hybrid key agreement for TLS 1.3, Aug 2026.
https://www.rfc-editor.org/info/rfc10024/ - Treasury Board of Canada. SPIN: Migrating the Government of Canada to Post-Quantum Cryptography, 9 Oct 2025.
https://www.canada.ca/en/government/system/digital-government/policies-standards/spin/migrating-government-canada-post-quantum-cryptography.html - Microsoft Teams outage, 3 Feb 2020. Expired authentication certificate.
https://www.geekwire.com/2020/microsofts-slack-competitor-teams-due-expired-authentication-certificate/ - Ericsson SGSN-MME, 6 Dec 2018. Expired software certificate; O2 UK and SoftBank Japan.
https://www.theregister.com/2018/12/06/ericsson_o2_telefonica_uk_outage/ - Logitech macOS applications, 6 Jan 2026. Expired Developer ID certificate.
https://www.macrumors.com/2026/01/07/logitech-certificate-breaks-macos-apps/ - NIST IR 8610. Status report on the second round of additional digital signature schemes, 14 May 2026. Nine schemes to round three.
https://csrc.nist.gov/pubs/ir/8610/final - NIST IR 8545. Status report on the fourth round; HQC selected, 11 Mar 2025.
https://csrc.nist.gov/pubs/ir/8545/final - NIST presentation. FIPS 206, FN-DSA (FALCON). Source of the 666-byte signature figure; the standard is unpublished.
https://csrc.nist.gov/csrc/media/presentations/2025/fips-206-fn-dsa-(falcon)/images-media/fips_206-perlner_2.1.pdf - HQC specification site. Parameter sizes for HQC-1, HQC-3 and HQC-5.
https://pqc-hqc.org/ - FrodoKEM specification site. Parameter sets and their NIST security levels.
https://frodokem.org/ - Classic McEliece specification site.
https://classic.mceliece.org/ - Open Quantum Safe, liboqs algorithm tables. Per-parameter-set key, ciphertext and signature sizes, reproduced from each specification.
https://github.com/open-quantum-safe/liboqs/tree/main/docs/algorithms - UK NCSC. Timelines for migration to post-quantum cryptography. Discovery by 2028, highest-priority migration by 2031, complete by 2035.
https://www.ncsc.gov.uk/guidance/pqc-migration-timelines - KpqC project. SMAUG-T, NTRU+, HAETAE and AIMer specifications. Final selections announced Jan 2025.
https://kpqc.or.kr/ - NIST PQC standards page. Describes the fourth signature standard only as derived from FALCON; assigns no number.
https://csrc.nist.gov/Projects/post-quantum-cryptography/pqc-standards - SMAUG-T specification v3.0. Table 1 gives public key and ciphertext sizes for four parameter sets.
https://kpqc.or.kr/images/pdf/SMAUG-T_Document.pdf - HAETAE specification. Table 1 gives public key size and expected signature size with rANS; signatures are variable length.
https://kpqc.or.kr/images/pdf/HAETAE.pdf - AIMer specification. Table 1 gives signature size per number of parties N, which is a parameter choice rather than a security level.
https://kpqc.or.kr/images/pdf/AIMer.pdf - NIST PQC security evaluation criteria. Defines the five security strength categories and the reference primitive each is pegged to.
https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria)
79 sources. Last generated from the book source on October 2026.