Post-Quantum Cryptography: ML-DSA certificate issuance and key generation (Go 1.27 crypto/mldsa now accepted)

[netanmangal]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Summary

step-ca's blog post
stated that PQC certificate support was blocked by Go's standard library lacking ML-DSA.
That blocker is now resolved: Go 1.27's crypto/mldsa proposal has been
Accepted and will ship with full
crypto/x509 ML-DSA support (certificate signing, CSR generation, verification).

This issue requests a concrete plan for ML-DSA certificate issuance in step-ca and
ML-DSA key generation in step CLI.

Current State

Capability	Status
ML-KEM hybrid TLS key exchange	Shipped (v0.28.3+, via Go runtime)
ML-DSA key generation (step CLI)	Not available
ML-DSA certificate issuance (step-ca)	Not available
Hybrid X.509 certificates	Not available
PKI Consortium PQCCM entry	All categories: "Not available"

What Go 1.27 Delivers (shipping ~Aug/Sep 2026)

• crypto/mldsa package — ML-DSA-44, ML-DSA-65, ML-DSA-87
• crypto/x509 — ML-DSA key support for certificate creation and verification
• crypto/tls — ML-DSA signatures in TLS 1.3

This is the exact dependency step-ca was waiting for.

Request

1. step CLI: ML-DSA key generation

step crypto keypair ml-dsa.pub ml-dsa.key --kty ML-DSA --curve ML-DSA-65

2. step-ca: ML-DSA certificate signing

• SelfSigned issuer: sign certificates with ML-DSA CA keys
• CA issuer: issue ML-DSA leaf certificates from ML-DSA roots
• ACME issuer: ML-DSA CSR processing (when Let's Encrypt supports PQC)

3. Hybrid certificates (future)

• Composite ML-DSA + ECDSA per draft-ietf-lamps-pq-composite-sigs

Competitive Context

• Microsoft AD CS: ML-DSA certificate issuance GA (May 2026)
• AWS Private CA: PQC certificates GA (November 2025)
• OpenSSL 3.5+: ML-DSA certificate creation supported
• step-ca risks falling behind as the leading open-source private CA

Why is this needed?

France's ANSSI will stop certifying non-PQC products from 2027. Organizations using step-ca for internal PKI will need PQC certificates to maintain compliance.

References

• Discussion #1395 (prior PQC discussion)
• Go crypto/mldsa proposal (Accepted)
• NIST FIPS 204 (ML-DSA)
• Smallstep PQC blog post
• PKI Consortium PQCCM

[netanmangal]

And, I'd be happy to take it up and implement.

[hslatman]

Hey @netanmangal,

We have made some progress on this in #2785.