Auditing OpenSSH, OpenSSL & X.509 for the 2031 Post-Quantum (BSI TR-02102-1 & NIS-2) Deadline with a Zero-Dependency Python CLI

A developer released bsi_pqc_check.py, a zero-dependency Python CLI built on the standard library that audits OpenSSH sshd_config and host keys, OpenSSL configuration, and X.509 PEM/CRT certificates against BSI TR-02102-1 post-quantum requirements ahead of the 2031 deadline. The scanner flags legacy algorithms such as ssh-rsa, ecdsa-sha2-nistp256, SHA-1 key exchange, RSA keys under 3072 bits, and missing hybrid PQC groups like X25519MLKEM768, and exports CBOM CSV and JSON output for ISO 27001 and BSI IT-Grundschutz audits. The release is accompanied by a browser-based NIS-2 compliance-gap calculator and paid Excel audit workbooks.

With the updated BSI Technical Guideline TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths and the NIS-2 Directive § 30 & § 38 BSIG in Germany and the EU, DevSecOps engineers, CISOs, and Linux infrastructure teams face a hard regulatory deadline: RSA-2048 , Diffie-Hellman, and non-hybrid elliptic curve key exchanges ECDH / X25519 alone are being phased out by the end of ML-KEM-768 / ML-KEM-1024 ML-DSA To automate host-level verification without installing heavy agents, we built an open-source, zero-dependency Python CLI scanner bsi pqc check.py alongside an interactive browser calculator and audit workbooks. bsi-tr02102-pqc-audit-cli GitHub Repository: 👉 github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli bsi pqc check.py uses 100% Python Standard Library stdlib and inspects: sshd config & Host Keys per BSI TR-02102-4 : ssh-rsa , ecdsa-sha2-nistp256 , and SHA-1 KEX while checking for hybrid PQC key exchange mlkem768x25519-sha256 in OpenSSH 9.9+ and sntrup761x25519-sha512@openssh.com . openssl.cnf per BSI TR-02102-2 : MinProtocol = TLSv1.3 , and hybrid Groups X25519MLKEM768 , SecP256r1MLKEM768 . .pem / .crt : RSA < 3072-bit keys, legacy signature hashes SHA-1 , MD5 , and exports a machine-readable --generate-cbom-csv --json-out for ISO 27001 / BSI IT-Grundschutz audits. pipx Run directly via pipx and generate a local CBOM CSV + HTML Audit Report: pipx run git+https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli.git --generate-cbom-csv Or run via curl 100% Python stdlib, read-only : curl -sSL https://raw.githubusercontent.com/KenanErorr404/bsi-tr02102-pqc-audit-cli/main/bsi pqc check.py | python3 - /etc/ssh/sshd config.d/10-bsi-tr02102-pqc.conf BSI TR-02102-4 Hybrid-PQC KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com Need to quantify your 2031 Compliance-Gap-Score and NIS-2 fine exposure § 60 BSIG in 60 seconds? 👉 Launch the Client-Side BSI PQC & NIS-2 Calculator pqc-nis2-rechner.html https://kenanerorr404.github.io/de-compliance-kompass/pqc-nis2-rechner.html 100% local in-browser calculation, zero tracking cookies, instant protocol-by-protocol remediation roadmap . €0+ Starter Pack & Enterprise .xlsx Compliance Suite For teams preparing for an external ISO 27001 , BSI IT-Grundschutz , NIS-2 § 30 BSIG , or KRITIS audit: BSI-Audit-Matrix-Leseprobe.csv 6 sample audit rows covering TLS 1.3, SSHv2, IPsec/IKEv2, and Secure SDLC plus a BSI2026PRO BSI-TR-02102-CBOM-und-Risiko-Matrix-2031.xlsx 3-tab Excel workbook with live KPI formulas, 45-row CBOM inventory across TLS/SSH/IPsec/PKI/KMS/DB, and NIS-2 § 38 BSIG Sign-Off Log Krypto-Inventar-PQC-2031.csv PQC-Migrationsplan-2026-2031.md Management-Vorlage-Haftungsfreistellung-BSIG38.html Printable C-level resolution template for § 38 BSIG liability protection .yml