A cryptographic bill of materials for the estate, a post-quantum readiness score, the migration plan and the compliance deadlines — built from the certificates, TLS and SSH configurations, CA keys, device facts and the live transport facts the Versus agents report.
"Harvest now, decrypt later" is the reason this page exists. Traffic protected by classical key exchange can be recorded today and decrypted once a cryptographically relevant quantum computer arrives; certificates signed with RSA or ECDSA will stop being trustworthy; and the deadlines are already published (NIST IR 8547 deprecates quantum-vulnerable algorithms in 2030 and disallows them in 2035; the CA/Browser Forum shortens certificate lifetimes to 47 days by 2029). Quantum Readiness turns that into an inventory, a score, a plan and evidence.
It lives under TLS Cert LCM → Quantum Readiness and needs no agent on the devices: it reads what Versus already knows, plus the handshake facts the collectors and endpoint agents report about their own connections.
Read-only by design. The page computes and plans. The device-changing steps (switching a BIG-IP to a hybrid key-exchange group, re-issuing certificates on a PQ-capable CA) are governed workflow steps in later phases of the roadmap.
Press Recompute (or schedule pqc_recompute) and Versus builds one crypto asset per item it can see:
| Source | Assets |
|---|---|
| ADC certificates and TLS profiles | certificate algorithm, key size, signature, lifetime; the profile's key-exchange groups and protocol floor |
| Certificate records from CLM and managed certificates | the same facts for everything the lifecycle manager tracks |
| Device configurations | SSH key exchange and host keys, SSL settings and IKE proposals where the vendor parser exposes them (Cisco ASA today; other vendors contribute certificates and TLS profiles) |
| Versus CA accounts | CA key algorithms and sizes |
| Versus itself | the platform's own primitives: CA profiles, Ed25519 signers for licences, manifests and task dispatch, the Vault envelope, the collector and endpoint transport |
| Observed, live | the TLS version, cipher and key-exchange group each collector and endpoint agent negotiated with Versus, and the SSH key exchange, host key and ciphers negotiated with every device the agents manage |
The observed rows are what make the score honest: an agent that negotiated the hybrid X25519 + ML-KEM-768 group shows as safe; a FIPS-mode collector that cannot offer it shows as blocked by policy; a device whose SSH only speaks classical groups shows exactly which groups it offered.
Each asset gets findings from a fixed rule set: quantum-vulnerable signature, weak key size, classical key exchange (with HNDL exposed when the data's lifetime outlasts 2030), weak key-exchange group, certificate lifetime over 47 days, and more. A finding carries the recommended action and, where the vendor cannot do it yet, what blocks it (for example the minimum BIG-IP version for a hybrid group).
Export produces a CycloneDX 1.6 CBOM (cryptographic-asset components, algorithm components and dependencies) or a 31-column CSV; every export is recorded.
The endpoint agent reports the TLS version, cipher and group it negotiated for every probe it runs, so client-side handshakes to your services appear in the inventory too, and certificates in personal stores or with findings join the CBOM. On the collector side, SSH drivers prefer the hybrid ML-KEM key exchange and report what each device actually agreed to. FIPS 140-3 mode is available on both agents; note that in FIPS mode the SSH client offers only the hybrid and NIST-curve groups, so TLS 1.0-era devices become unreachable.
The Versus MCP server serves four read-only tools on this data: crypto_inventory (the CBOM rows with filters), pqc_readiness (the summary), cbom_export (the CycloneDX or CSV document) and pqc_waves (the migration plan). The assistant answers "which devices still negotiate classical key exchange?" from the same rows.
Dual-signed manifests and licences and a PQ-capable CA (ML-DSA) wait for library support in the platform's language runtimes; Versus never claims post-quantum signatures before that lands. Device-changing migration steps and the PQ-hybrid profile roll-out are the next phases of the Crypto-Agility roadmap.
/api/pqc/{assets, findings, scores, summary, recompute, export, exports, waves, waves/rebuild, waves/<id>/state, report, report/export, audit}; manage.py pqc_recompute [--tenant].