Post-Quantum TLS and PKI Migration Plan for a Cross-Border Bank
Overview
What this challenge is about.
Score endpoint readiness, design a hybrid handshake pilot, and build a 36-month roadmap for a cross-border bank. Earn a verifiable certificate.
The scenario
Helvana Bank is a BaFin-regulated mid-cap retail and corporate bank in Frankfurt with about 11,000 employees and operations in five European countries, exposed to the EU Digital Operational Resilience Act (DORA) requirements for managing technology risk. Its security posture rests on roughly 1,800 TLS-protected service endpoints and a four-tier internal certificate authority, both of which face obsolescence as quantum computing threatens current public-key cryptography.
The Brief
What you'll do, and what you'll demonstrate.
Design a defensible 36-month post-quantum migration plan, anchored by a 30-endpoint hybrid-handshake pilot, that a BaFin examiner will accept as credible evidence of cryptographic agility.
Earning criteria — what you'll demonstrate
- Translate a TLS endpoint inventory and PKI hierarchy into a reproducible, risk-weighted post-quantum readiness score
- Design a hybrid post-quantum TLS 1.3 handshake pilot with measurable telemetry, rollback criteria, and client-compatibility coverage
- Sequence a multi-year cryptographic migration that respects vendor and library dependencies and certificate-authority hierarchy
- Communicate cryptographic-agility risk and regulatory readiness to both technical operators and a non-technical board
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Tls
Apply tls to solve real industry problems and demonstrate production-level capability.
- Pki
Apply pki to solve real industry problems and demonstrate production-level capability.
- Post Quantum Cryptography
Apply post quantum cryptography to solve real industry problems and demonstrate production-level capability.
- Crypto Agility
Apply crypto agility to solve real industry problems and demonstrate production-level capability.
- Protocol Security
Apply protocol security to solve real industry problems and demonstrate production-level capability.
- Roadmap Planning
Apply roadmap planning to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
Cryptography Migration Engineer
This challenge mirrors the core work of planning and piloting a move to post-quantum algorithms across a large estate, teaching you to score endpoints, design hybrid handshakes, and sequence multi-year change without breaking production services.
This challenge sharpens
- post-quantum-cryptography
- crypto-agility
- tls
PKI and Certificate Lifecycle Engineer
Working from a four-tier certificate authority hierarchy to plan re-issuance under new signature algorithms builds the exact skills a PKI engineer needs to manage trust hierarchies, certificate rotation, and algorithm transitions at enterprise scale.
This challenge sharpens
- pki
- post-quantum-cryptography
- roadmap-planning
Security Architect, Financial Services
Producing a regulator-defensible roadmap and board readout bridges directly to security architecture roles in banking, where you must align protocol-level security decisions with supervisory expectations and multi-year delivery plans.
This challenge sharpens
- protocol-security
- roadmap-planning
- crypto-agility