PKI Modernization: Why the 2029 Quantum Deadline Matters

Modernizing public key infrastructure (PKI) is becoming increasingly urgent as organizations prepare for the security risks posed by quantum computing.

PKI provides a framework for creating, managing, and revoking digital certificates that establish trust across digital networks. As quantum computing advances, companies must prepare to replace vulnerable public-key cryptography in their systems.

“Prioritize migration to quantum security,” DigiCert Inc. CEO Amit Sinha (pictured) said during an interview with theCUBE, SiliconANGLE Media’s livestreaming studio. “PKI modernization is long overdue. If you don’t start today, you’re already running out of time.”

Quantum risks and what companies need to prepare for a post-quantum world were the focus of DigiCert’s World Quantum Readiness Day 2026 virtual event, reported on by theCUBE. Security leaders and public key infrastructure teams examined how to inventory cryptographic assets, prioritize migration, evaluate quantum-safe algorithms, and prepare for the quantum age. (*Disclosure below.)

Here are three key takeaways you may have missed from theCUBE’s coverage of DigiCert’s World Quantum Readiness Day 2026 virtual event:

Insight #1: PKI modernization requires a phased approach across jurisdictions.

Before organizations can plan a migration, they need to understand where cryptography will be used. Sinha says DigiCert’s Quantum Central is designed to help assess this risk, while shorter certificate lifespans increase pressure to automate certificate management.

“The path to crypto agility with the 47-day mandate is much the same path to post-quantum cryptography,” Sinha said. “Both of those deadlines are now 2029, so we need to have a good system that brings together public and private PKI [and] Having last-mile automation capabilities that give you crypto agility are fundamental steps – both for the 47-day mandate we have today and for the migration to post-quantum cryptography.”

Post-quantum cryptography requires flexibility as organizations in different jurisdictions apply different standards. Many countries are adopting standards developed by the U.S. National Institute of Standards and Technology, while others are taking different approaches. China has launched a program to request and evaluate quantum-resistant cryptographic algorithms for possible standardization.

“I find [different standards] will influence [PQC]” said Jostein Stokkan, product manager for service offerings at Atea Norge AS, during an interview with theCUBE. “But if we can help organizations become more crypto-agile and be able to adapt to different types of encryption as they become important or simply change, I think everything will run more smoothly and easily for everyone involved.”

A smoother transition also depends on how companies allocate resources and identify the teams and service owners responsible for implementation. According to Christian Pfister, IT security team leader and head of LGT’s Quantum Safe Competence Center, LGT Financial Services AG began asking providers about supported algorithms and compatibility restrictions at least two years ago.

“If you try to inventory, replace and validate every cryptographic use case at once, the program becomes uncontrollable and you cannot measure the result,” he told theCUBE. “The [post-quantum cryptography] Migration is not a project and an algorithm change; it’s a series of waves of migration.”

Insight #2: Unresolved questions lead to calls for advice and practical testing.

A survey published by DigiCert found that 87% of organizations surveyed were planning, testing or implementing post-quantum cryptography initiatives, while only 7% had deployed quantum secure or hybrid cryptography in most of their digital certificates. The gap between planning and delivery leaves organizations wondering how to proceed.

“There is no one-size-fits-all solution, there is no template,” said Naomi Wynn, executive director of the National Energy Public Key Infrastructure (NEPKI), during an appearance at the event. “But I’m hoping that by this time next year… we’ll also see improved guidance in terms of expectations and what’s good enough [and] what actually meets the requirements.”

Organizations are also testing how post-quantum cryptography will work in their existing environments. The Daiwa Institute of Research Ltd. conducted a proof of concept for Daiwa Securities Group using a post-quantum capable load balancer to evaluate transport layer security performance.

“In our measurements, the average TLS handshake time increased by about 1.2 milliseconds,” said Sadaaki Yamazaki, senior security specialist for the digital solutions research and development department at Daiwa Institute of Research Ltd. “In our environment operating in a high-bandwidth data center, the impact was negligible. However, PQC increased both message size and packet count. Organizations operating over wireless networks or bandwidth-constrained environments should carefully validate the impact in their own environments.”

Insight #3: Post-quantum migration requires coordination between systems and suppliers.

Quantum computing still faces challenges in areas such as error correction, scaling, and hardware and software. For companies preparing their security systems, Colin Soutar, managing director of Deloitte, says practical testing and step-by-step planning can help narrow down the problem.

“I would take out the word ‘quantum,'” Soutar said during an appearance at the event. “I think the misconception is that you have to be an expert [or] You must have a physics background to understand what is needed here. There is a threat to the future… and the measures to contain it are well known. Reworking is relatively easy, although extensive and complex.”

Microsoft Corp. has set a goal to transition its products and services to post-quantum cryptography by 2029. According to Karina Sirota Goodley, senior security product manager at Microsoft, the Trusted Root Program pilot involves certificate authorities in this effort.

“Certification authorities can test issuance and compatibility with Microsoft platform features in a controlled environment,” she told theCUBE. “This is important because no single component can proclaim success. The entire chain has to work.”

Register for free to view the full video interviews that are part of SiliconANGLE and theCUBE Research’s coverage of DigiCert’s World Quantum Readiness Day.

(*Disclosure: TheCUBE is a paid media partner for DigiCert’s World Quantum Readiness Day virtual event. Neither DigiCert, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over theCUBE or SiliconANGLE content.)

Photo: SiliconANGLE