# Auditing OpenSSH, OpenSSL & X.509 for the 2031 Post-Quantum (BSI TR-02102-1 & NIS-2) Deadline with a Zero-Dependency Python CLI

> Source: <https://dev.to/kenanerorr404/auditing-openssh-openssl-x509-for-the-2031-post-quantum-bsi-tr-02102-1-nis-2-deadline-with-5ad1>
> Published: 2026-11-03 20:36:21+00:00

With the updated **BSI Technical Guideline TR-02102-1** (*Cryptographic Mechanisms: Recommendations and Key Lengths*) and the **NIS-2 Directive (§ 30 & § 38 BSIG)** in Germany and the EU, DevSecOps engineers, CISOs, and Linux infrastructure teams face a hard regulatory deadline:

`RSA-2048`, Diffie-Hellman, and non-hybrid elliptic curve key exchanges (`ECDH` / `X25519` alone) are being phased out by the end of `ML-KEM-768` / `ML-KEM-1024`)` ML-DSA`)
To automate host-level verification without installing heavy agents, we built an open-source, **zero-dependency Python CLI scanner (`bsi_pqc_check.py`)** alongside an interactive browser calculator and audit workbooks.

`bsi-tr02102-pqc-audit-cli`)
**GitHub Repository:** 👉 [github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli](https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli)

`bsi_pqc_check.py` uses **100% Python Standard Library (`stdlib`)** and inspects:

`sshd_config` & Host Keys per BSI TR-02102-4):`ssh-rsa`, `ecdsa-sha2-nistp256`, and SHA-1 KEX while checking for hybrid PQC key exchange (` mlkem768x25519-sha256` in OpenSSH 9.9+ and `sntrup761x25519-sha512@openssh.com`).` openssl.cnf` per BSI TR-02102-2):`MinProtocol = TLSv1.3`, and hybrid `Groups` (`X25519MLKEM768`, `SecP256r1MLKEM768`).`.pem` / `.crt`):` RSA < 3072-bit` keys, legacy signature hashes (`SHA-1`, `MD5`), and exports a machine-readable `--generate-cbom-csv`)`--json-out`) for ISO 27001 / BSI IT-Grundschutz audits.` pipx`)

```
# Run directly via pipx and generate a local CBOM CSV + HTML Audit Report:
pipx run git+https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli.git --generate-cbom-csv

# Or run via curl (100% Python stdlib, read-only):
curl -sSL https://raw.githubusercontent.com/KenanErorr404/bsi-tr02102-pqc-audit-cli/main/bsi_pqc_check.py | python3 -
# /etc/ssh/sshd_config.d/10-bsi-tr02102-pqc.conf (BSI TR-02102-4 Hybrid-PQC)
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
```

Need to quantify your **2031 Compliance-Gap-Score** and **NIS-2 fine exposure (§ 60 BSIG)** in 60 seconds?

👉 [Launch the Client-Side BSI PQC & NIS-2 Calculator (`pqc-nis2-rechner.html`)](https://kenanerorr404.github.io/de-compliance-kompass/pqc-nis2-rechner.html)

*(100% local in-browser calculation, zero tracking cookies, instant protocol-by-protocol remediation roadmap).*

`€0+` Starter Pack & Enterprise `.xlsx` Compliance Suite
For teams preparing for an external **ISO 27001**, **BSI IT-Grundschutz**, **NIS-2 (§ 30 BSIG)**, or **KRITIS** audit:

`BSI-Audit-Matrix-Leseprobe.csv` (6 sample audit rows covering TLS 1.3, SSHv2, IPsec/IKEv2, and Secure SDLC) plus a `BSI2026PRO`)` BSI-TR-02102-CBOM-und-Risiko-Matrix-2031.xlsx` (3-tab Excel workbook with live KPI formulas, 45-row CBOM inventory across TLS/SSH/IPsec/PKI/KMS/DB, and NIS-2 § 38 BSIG Sign-Off Log)`Krypto-Inventar-PQC-2031.csv`` PQC-Migrationsplan-2026-2031.md``Management-Vorlage-Haftungsfreistellung-BSIG38.html` (Printable C-level resolution template for § 38 BSIG liability protection)`.yml`)