live wire
▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security
upstreambeat.ai
releaseSECURITY

Red Hat Certificate System 11 brings post-quantum algorithms into enterprise PKI

The Dogtag-based certificate authority adds ML-DSA signatures and ML-KEM key encapsulation while integrating with RHEL cryptographic policy and automated enrollment.

Classical PKI versus post-quantum certificate authority.
AI-generated illustration
By The News Desk· Sep 9, 2026the quick take — two AI hosts go live when you do

Red Hat Certificate System 11 now supports the standardized post-quantum algorithms ML-DSA for digital signatures and ML-KEM for key encapsulation. The change puts quantum-resistant certificate issuance and lifecycle management into Red Hat’s Dogtag-based enterprise public-key infrastructure rather than leaving it as an application-by-application experiment.

What changed

Red Hat says Certificate System 11 can issue, manage and revoke X.509 post-quantum certificates across hybrid-cloud environments. It integrates with RHEL Global Cryptographic Policies, allowing administrators to change the operating system’s cryptographic posture centrally instead of reconfiguring each application separately.

The product supports automated enrollment through EST and ACME and provides certificate-authority, key-recovery and Online Certificate Status Protocol services. Red Hat positions those existing lifecycle functions as important for post-quantum adoption because larger keys, transitional dual signatures and shorter certificate lifetimes can multiply renewal work.

The company also points to an Ansible Automation Platform discovery workflow for finding legacy certificates and other cryptographic attributes across a fleet. That creates a two-stage migration path: inventory classical cryptography first, then use Certificate System as the trust anchor for replacement credentials.

Who should care

The immediate audience is platform-security and PKI teams responsible for long-lived sensitive data, regulated systems or large hybrid estates. Developers are affected indirectly: moving algorithm policy and certificate rotation into shared infrastructure can reduce the number of cryptographic decisions embedded in individual applications.

The release does not make every application post-quantum-safe by itself. Protocol compatibility, certificate-chain size, hardware security modules, clients and network devices still need testing. A certificate authority that can issue ML-DSA or use ML-KEM is one dependency in a migration, not the whole migration.

What to do

Teams should begin with an inventory of certificates, algorithms, expiration periods and application dependencies. They should identify systems that must retain confidentiality for many years and test hybrid or post-quantum chains in representative environments before changing fleet-wide policy.

Certificate System 11’s RHEL policy integration and automated enrollment are the operational features to validate first. Administrators should measure handshake and payload changes, confirm client support, and rehearse rollback. Red Hat’s announcement establishes product capability, but each organization still needs a staged interoperability plan before replacing classical public-key cryptography in production.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk