{"slug": "auditing-openssh-openssl-x-509-for-the-2031-post-quantum-bsi-tr-02102-1-nis-2-a", "title": "Auditing OpenSSH, OpenSSL & X.509 for the 2031 Post-Quantum (BSI TR-02102-1 & NIS-2) Deadline with a Zero-Dependency Python CLI", "summary": "A developer released bsi_pqc_check.py, a zero-dependency Python CLI built on the standard library that audits OpenSSH sshd_config and host keys, OpenSSL configuration, and X.509 PEM/CRT certificates against BSI TR-02102-1 post-quantum requirements ahead of the 2031 deadline. The scanner flags legacy algorithms such as ssh-rsa, ecdsa-sha2-nistp256, SHA-1 key exchange, RSA keys under 3072 bits, and missing hybrid PQC groups like X25519MLKEM768, and exports CBOM CSV and JSON output for ISO 27001 and BSI IT-Grundschutz audits. The release is accompanied by a browser-based NIS-2 compliance-gap calculator and paid Excel audit workbooks.", "body_md": "With the updated **BSI Technical Guideline TR-02102-1** (*Cryptographic Mechanisms: Recommendations and Key Lengths*) and the **NIS-2 Directive (§ 30 & § 38 BSIG)** in Germany and the EU, DevSecOps engineers, CISOs, and Linux infrastructure teams face a hard regulatory deadline:\n\n`RSA-2048`, Diffie-Hellman, and non-hybrid elliptic curve key exchanges (`ECDH` / `X25519` alone) are being phased out by the end of `ML-KEM-768` / `ML-KEM-1024`)` ML-DSA`)\nTo automate host-level verification without installing heavy agents, we built an open-source, **zero-dependency Python CLI scanner (`bsi_pqc_check.py`)** alongside an interactive browser calculator and audit workbooks.\n\n`bsi-tr02102-pqc-audit-cli`)\n**GitHub Repository:** 👉 [github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli](https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli)\n\n`bsi_pqc_check.py` uses **100% Python Standard Library (`stdlib`)** and inspects:\n\n`sshd_config` & Host Keys per BSI TR-02102-4):`ssh-rsa`, `ecdsa-sha2-nistp256`, and SHA-1 KEX while checking for hybrid PQC key exchange (` mlkem768x25519-sha256` in OpenSSH 9.9+ and `sntrup761x25519-sha512@openssh.com`).` openssl.cnf` per BSI TR-02102-2):`MinProtocol = TLSv1.3`, and hybrid `Groups` (`X25519MLKEM768`, `SecP256r1MLKEM768`).`.pem` / `.crt`):` RSA < 3072-bit` keys, legacy signature hashes (`SHA-1`, `MD5`), and exports a machine-readable `--generate-cbom-csv`)`--json-out`) for ISO 27001 / BSI IT-Grundschutz audits.` pipx`)\n\n```\n# Run directly via pipx and generate a local CBOM CSV + HTML Audit Report:\npipx run git+https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli.git --generate-cbom-csv\n\n# Or run via curl (100% Python stdlib, read-only):\ncurl -sSL https://raw.githubusercontent.com/KenanErorr404/bsi-tr02102-pqc-audit-cli/main/bsi_pqc_check.py | python3 -\n# /etc/ssh/sshd_config.d/10-bsi-tr02102-pqc.conf (BSI TR-02102-4 Hybrid-PQC)\nKexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org\nHostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com\nMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com\n```\n\nNeed to quantify your **2031 Compliance-Gap-Score** and **NIS-2 fine exposure (§ 60 BSIG)** in 60 seconds?\n\n👉 [Launch the Client-Side BSI PQC & NIS-2 Calculator (`pqc-nis2-rechner.html`)](https://kenanerorr404.github.io/de-compliance-kompass/pqc-nis2-rechner.html)\n\n*(100% local in-browser calculation, zero tracking cookies, instant protocol-by-protocol remediation roadmap).*\n\n`€0+` Starter Pack & Enterprise `.xlsx` Compliance Suite\nFor teams preparing for an external **ISO 27001**, **BSI IT-Grundschutz**, **NIS-2 (§ 30 BSIG)**, or **KRITIS** audit:\n\n`BSI-Audit-Matrix-Leseprobe.csv` (6 sample audit rows covering TLS 1.3, SSHv2, IPsec/IKEv2, and Secure SDLC) plus a `BSI2026PRO`)` BSI-TR-02102-CBOM-und-Risiko-Matrix-2031.xlsx` (3-tab Excel workbook with live KPI formulas, 45-row CBOM inventory across TLS/SSH/IPsec/PKI/KMS/DB, and NIS-2 § 38 BSIG Sign-Off Log)`Krypto-Inventar-PQC-2031.csv`` PQC-Migrationsplan-2026-2031.md``Management-Vorlage-Haftungsfreistellung-BSIG38.html` (Printable C-level resolution template for § 38 BSIG liability protection)`.yml`)", "url": "https://wpnews.pro/news/auditing-openssh-openssl-x-509-for-the-2031-post-quantum-bsi-tr-02102-1-nis-2-a", "canonical_source": "https://dev.to/kenanerorr404/auditing-openssh-openssl-x509-for-the-2031-post-quantum-bsi-tr-02102-1-nis-2-deadline-with-5ad1", "published_at": "2026-11-03 20:36:21+00:00", "updated_at": "2026-11-03 20:52:37.315230+00:00", "lang": "en", "topics": ["ai-policy", "developer-tools"], "entities": ["BSI", "OpenSSH", "OpenSSL", "NIS-2", "GitHub", "KenanErorr404"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/auditing-openssh-openssl-x-509-for-the-2031-post-quantum-bsi-tr-02102-1-nis-2-a", "markdown": "https://wpnews.pro/news/auditing-openssh-openssl-x-509-for-the-2031-post-quantum-bsi-tr-02102-1-nis-2-a.md", "text": "https://wpnews.pro/news/auditing-openssh-openssl-x-509-for-the-2031-post-quantum-bsi-tr-02102-1-nis-2-a.txt", "jsonld": "https://wpnews.pro/news/auditing-openssh-openssl-x-509-for-the-2031-post-quantum-bsi-tr-02102-1-nis-2-a.jsonld"}}