October 15, 2026
With the new PQC Upgrade Package, DARZ Managed PKI & CLM powered by MTG—the managed solution for Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM)—can be expanded to include quantum-secure signature algorithms. This enables companies to prepare their PKI today for the challenges posed by quantum computers without having to operate their own PKI.
In the long term, quantum computers will render classical cryptographic methods such as RSA and elliptic curve cryptography (EC) vulnerable to attack. For PKI, this means that new signature algorithms must be introduced. As certificates and hierarchies of certificate authorities (CAs) are often in use for many years, it is important to plan the transition well in advance. The EU has also presented a roadmap: high-risk applications, such as those in critical infrastructure, are to be migrated to PQC by the end of 2030 at the latest.
The PQC upgrade package extends the DARZ Managed PKI & CLM with the following components:
Support for the PQC signature algorithms ML-DSA and SLH-DSA, standardised by the National Institute of Standards and Technology (NIST)
A dedicated root CA for each PQC algorithm used
The required PQC licence and the PQC configuration of the hardware security modules (HSM)
The CA keys are stored in a PQC-capable shared HSM infrastructure, with each customer receiving a dedicated, cryptographically isolated HSM partition. The Securosys HSMs used support the PQC algorithms MLS-DSA and SLH-DSA.
In future, further selected PQC algorithms are to be added. Crypto-agility means that cryptographic methods can be changed without having to rebuild the infrastructure. This is a key aspect of PQC migration. Existing root CAs for RSA or EC are retained, whilst PQC root CAs are set up in addition. This allows classical and quantum-secure certificates to be used side by side, and applications to be migrated step by step.
The PQC upgrade package can be added to the BUSINESS and ENTERPRISE plans. Customers requiring a fully dedicated HSM infrastructure can also combine the package with dedicated, PQC-capable HSM hardware as part of the ENTERPRISE plan.
With the PQC-PKI on the FREE plan, you can try out PQC free of charge. Create and manage up to 50 active PQC certificates using the NIST-standardised ML-DSA and SLH-DSA algorithms, and test typical use cases. The PQC-PKI is intended solely for testing purposes: the PQC keys are protected by software only and are not stored in HSMs.
The DARZ Managed PKI & CLM is based on MTG ERS® technology and is operated exclusively by our partner DARZ in the multi-certified data centres in Darmstadt and Frankfurt; in the BUSINESS and ENTERPRISE plans, it is geographically redundant with 99.98 per cent high availability. DARZ is certified to ISO 27001 and has been assessed against the C5 (Type 2) criteria catalogue of the Federal Office for Information Security (BSI).
You can find all the information about the PQC upgrade package and the available plans on the DARZ Managed PKI & CLM website. Would you like some advice on your PQC migration? If so, please feel free to arrange a consultation.
This optional package extends DARZ Managed PKI & CLM to include the NIST-standardised signature schemes ML-DSA and SLH-DSA. It includes dedicated PQC root CAs, a licence and HSM configuration.
The PQC upgrade package is available for the BUSINESS and ENTERPRISE plans.
Crypto-agility means being able to switch between cryptographic methods without having to rebuild the infrastructure. This ensures that the PKI remains flexible for future standardised PQC algorithms.
For further information feel free to contact us!
