You are not migrating to post-quantum. Your CDN is.

A CDN can improve the cryptography used by your visitors without changing the systems behind it. That is useful progress. It is not proof that your origins, private APIs, VPNs or service-to-service connections have migrated.

Our position: judge crypto-agility by the changes your team can execute and verify. An inventory is necessary. A working replacement process is what makes it actionable.

Your adoption number may belong to your provider.

F5 Labs' September 2026 report measured the top one million domains. Its headline post-quantum adoption figure fell from 54% to 22% when Cloudflare-hosted domains were excluded. This is a result about that dataset and its classification, not a measurement of every organisation's internal estate. Read the F5 Labs report.

A separate longitudinal study established more than two billion TLS handshakes across one million domains and eleven vantage points. It likewise found adoption concentrated in managed infrastructure and centred on a hybrid construction. The authors distinguish observed deployment from policy ambitions. Read Mind the Gap.

Report the boundaries separately: browser to edge, edge to origin, and the connections inside your environment. A green first hop does not answer for the remaining hops.

Use the inventory to drive replacement.

A list of algorithms and certificates becomes useful when each entry has an owner, a dependency map and a tested change path. Record who can rotate the key, which clients must accept the replacement, how trust is distributed, and how the previous state can be restored.

Measure completion time, failure recovery and the number of assets without a tested rotation path. Do not discard discovery work or regulatory obligations. Connect them to an operational process instead of treating a completed spreadsheet as the end of the migration.

Shorter certificate lifetimes make the test concrete.

The CA/Browser Forum's SC081v3 schedule reduces the maximum validity of newly issued publicly trusted TLS certificates to 200 days from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029. These are public-Web-PKI issuance rules, not a universal lifetime requirement for every private certificate. Read the adopted ballot.

Let's Encrypt also offers opt-in certificates lasting 160 hours, just over six days. It says these are not planned to become the default. Its announced default-lifetime changes are separate: 64 days in February 2027 and 45 days in February 2028. Read the short-lived certificate announcement and the default-lifetime schedule.

A carefully scoped short-lived-certificate pilot can expose manual dependencies early. It is a stress test, not a requirement to put every production service on a six-day lifetime tomorrow. Monitor issuance, deployment and client acceptance, and exercise recovery before broadening the pilot.

Key agreement and authentication are different migrations.

Hybrid post-quantum key agreement addresses a different part of TLS from certificate signatures and the trust store. Observing X25519MLKEM768 does not establish that certificate authentication is post-quantum.

Let's Encrypt's June 2026 announcement describes its planned Merkle Tree Certificate path for post-quantum web authentication. That plan is a reason to track the browser and CA ecosystem; it is not evidence that all relying parties support the final design today. Read the CA's own announcement.

Private PKI has a different compatibility boundary. Evaluate algorithms, certificate formats, hardware and relying-party support against your actual applications. Neither a vendor label nor a public-web roadmap replaces that work.

Start with changes you can prove.

1. Measure key agreement on the connections you operate, with the endpoint and date attached to each observation.
2. Identify clients, libraries and middleboxes that constrain an algorithm change.
3. Pilot a supported hybrid configuration with compatibility tests and rollback.
4. Exercise automated certificate renewal and deployment on a bounded service.
5. Report which key classes still lack a rehearsed replacement path.

The useful question is not whether the roadmap says “post-quantum”. It is whether your team can replace the cryptography, keep the service working and show what changed.