Post-quantum readiness assessment
meisimusa.com
6 endpoints tested · 8 hostnames found in public certificate logs · scanned Jul 16, 2026
Report LS-1A0CAD99 · covers public, internet-facing endpoints only, not internal systems, cloud keys, or devices.
6 of 6 public endpoints negotiate post-quantum key exchange. All support TLS 1.3 and none accept obsolete protocols.
Basis for grade
Grade A. Every reachable public endpoint negotiates post-quantum key exchange. No endpoints were found using classical-only key exchange, obsolete TLS, or expired certificates.
Scoring criteria
| Post-quantum key exchange | 6 of 6 reachable endpoints negotiated post-quantum key exchange. | Pass |
| Obsolete TLS (1.0 / 1.1) | No endpoint accepts obsolete TLS 1.0 or 1.1. | Pass |
| TLS 1.3 support | All reachable endpoints support TLS 1.3. | Pass |
| Certificate signature algorithm | All certificates use classical (RSA / ECDSA) signature keys. This is expected: no public certificate authority issues post-quantum certificates yet. | Info |
| Certificate validity | No certificates expired or expiring within 21 days. | Pass |
Findings
- info
6 endpoints already negotiate post-quantum key exchange
Hybrid ML-KEM is active (X25519MLKEM768). Traffic to these endpoints is protected against retroactive decryption.
relay.meisimusa.com · mcp.meisimusa.com · api.meisimusa.com · bot.meisimusa.com · meisimusa.com · www.meisimusa.com
- medium
All 6 certificates use classical signature keys
A quantum computer can also break certificate keys (RSA/ECDSA), but this one is not urgent the way key exchange is. A signature only has to hold up while the certificate is still trusted, and nobody can forge it after the fact. No public certificate authority issues quantum-safe (ML-DSA) certificates yet, so there is nothing to switch to right now. NIST winds these algorithms down after 2030 and bars them after 2035.
relay.meisimusa.com · mcp.meisimusa.com · api.meisimusa.com · bot.meisimusa.com · meisimusa.com · www.meisimusa.com
Endpoints
| Host | Key exchange | TLS | Certificate key |
|---|---|---|---|
| relay.meisimusa.com | X25519MLKEM768 | TLSv1.3 | ECDSA prime256v1 |
| mcp.meisimusa.com | X25519MLKEM768 | TLSv1.3 | ECDSA prime256v1 |
| api.meisimusa.com | X25519MLKEM768 | TLSv1.3 | ECDSA prime256v1 |
| bot.meisimusa.com | X25519MLKEM768 | TLSv1.3 | ECDSA prime256v1 |
| meisimusa.com | X25519MLKEM768 | TLSv1.3 | RSA 2048 |
| www.meisimusa.com | X25519MLKEM768 | TLSv1.3 | RSA 2048 |
Compliance evidence
No security questionnaire asks about quantum yet. They do ask what cryptography you run and how you manage it, and most companies struggle to answer that with anything solid. A scan gives you something to point to.
CEK-04 CSA Cloud Controls Matrix | Encryption Algorithm Observed key exchange, cipher suite and certificate key algorithm for every reachable endpoint (6/6 endpoints on post-quantum key exchange). |
CEK-05 CSA Cloud Controls Matrix | Encryption Change Management Baseline of algorithms in use, so any cryptographic change is detectable against a known-good snapshot. |
CEK-07 CSA Cloud Controls Matrix | Encryption Risk Management Quantum exposure assessed per endpoint, separating retroactively-exploitable key exchange from forward-only signature risk. |
CEK-21 CSA Cloud Controls Matrix | Key Inventory Management 11 certificates and 8 hostnames enumerated from public Certificate Transparency logs. |
A.8.24 ISO/IEC 27001:2022 | Use of cryptography A dated record of the cryptographic algorithms actually running, which is what this control asks you to show. |
Crypto Inventory US EO 14412 / OMB M-26-15 | Automated Cryptographic Inventory Machine-generated inventory of cryptographic assets, exportable as a CycloneDX CBOM. |
The PDF is the readable report to share or attach to a questionnaire. The CBOM is the machine-readable inventory for security tools.
Recommended next steps
- 1.Extend this external assessment into a full cryptographic inventory that also covers internal systems: internal PKI, cloud key management, VPNs, databases, code signing, SSH, HSMs, application secrets, email certificates and identity systems.
- 2.Consult your internal PKI or security team, and a qualified cryptography assessor, to build a migration plan. For supply-chain purposes, an assessment under the PKI Consortium’s Post-Quantum Cryptography Maturity Model (PQCMM) provides an independent, standardized rating.
- 3.Follow the post-quantum migration guidance published by NIST and CISA, and, for federal contractors, the requirements of the June 2026 US executive order (EO 14412).
This is the outside view. A full inventory covers more.
This scan checks the cryptography that faces the internet, which is where harvest-now-decrypt-later actually happens and where you can start without giving anyone access. A complete post-quantum inventory, the kind auditors and the coming federal rules expect, also has to reach the cryptography inside your organization:
- ◦Internal PKI and private certificate authorities
- ◦Cloud key management (AWS KMS, Azure Key Vault, Google Cloud KMS)
- ◦VPNs and remote-access gateways
- ◦Databases and backup encryption
- ◦Code-signing and software-supply-chain keys
- ◦SSH keys and machine identities
- ◦HSMs and hardware roots of trust
- ◦Application secrets, OAuth, JWT signing
- ◦Email and S/MIME certificates
- ◦Identity systems, smart cards, PIV/CAC
A grade here reflects external posture only. It is a starting point for a full inventory, not a finished migration.
Contact us about a full assessment