Quantum computers capable of breaking RSA and elliptic-curve encryption do not exist yet. But encrypted traffic crossing the internet right now is already being captured and stored by well-resourced adversaries who plan to decrypt it later, once a large enough quantum computer exists. Security teams call this “harvest now, decrypt later,” and it is the reason post-quantum cryptography went from a research topic to a deployment checklist item in 2026. NIST finalized its first three post-quantum standards, FIPS 203, FIPS 204 and FIPS 205, in August 2024. OpenSSL answered with native support in version 3.5, shipped as a long-term-support release in April 2025. This tutorial walks through migrating a real TLS server to hybrid post-quantum key exchange using OpenSSL 3.5, from checking your current version through to a production rollout checklist. You will generate ML-KEM key pairs, test a hybrid handshake, sign certificates with ML-DSA, deploy the configuration in nginx, and see where the migration commonly breaks. Thirteen steps, roughly 75 minutes if you are working on a spare Linux box or a VM. Don't miss new tech stories on Google Add Tech Insider once in the Google app and our stories appear in your news suggestions. Why Post-Quantum Cryptography Migration Cannot Wait The math behind RSA and elliptic-curve Diffie-Hellman relies on problems that are hard for classical computers but not hard for a sufficiently large quantum computer running Shor’s algorithm. Nobody has built that machine yet, and estimates for when one might arrive still range from the early 2030s to well beyond. That uncertainty is exactly the problem. Data encrypted today with classical algorithms can be recorded now and decrypted later, so anything with a shelf life past that window, health records, source code, government files, trade secrets, is already exposed to a future key. NIST finalized FIPS 203,