Auditing OpenSSH, OpenSSL & X.509 for the 2031 Post-Quantum (BSI TR-02102-1 & NIS-2) Deadline with a Zero-Dependency Python CLI

With the updated BSI Technical Guideline TR-02102-1 (Cryptographic Mechanisms: Recommendations and Key Lengths) and the NIS-2 Directive (§ 30 & § 38 BSIG) in Germany and the EU, DevSecOps engineers, CISOs, and Linux infrastructure teams face a hard regulatory deadline:

1. End of Classical Asymmetric Cryptography (2031 / 2035): Classical RSA-2048, Diffie-Hellman, and non-hybrid elliptic curve key exchanges (ECDH / X25519 alone) are being phased out by the end of 2031 due to "Store Now, Decrypt Later" (SNDL) risks. Hybrid Post-Quantum Cryptography (PQC) — specifically FIPS 203 (ML-KEM-768 / ML-KEM-1024) and FIPS 204 (ML-DSA) — is now required for long-lived confidential data (healthcare/DiGA, KRITIS, finance, public sector).
2. Mandatory Cryptographic Bill of Materials (CBOM) under NIS-2 (§ 30 Abs. 2 Nr. 8 BSIG): Regulated entities must maintain an auditable inventory of active cryptographic protocols, key lengths, and certificates, backed by personal C-level liability under § 38 BSIG.

To automate host-level verification without installing heavy agents, we built an open-source, zero-dependency Python CLI scanner (bsi_pqc_check.py) alongside an interactive browser calculator and audit workbooks.

🔍 1. Open-Source Linux CLI Scanner (bsi-tr02102-pqc-audit-cli)

GitHub Repository: 👉 github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli

bsi_pqc_check.py uses 100% Python Standard Library (stdlib) and inspects:

• OpenSSH (sshd_config & Host Keys per BSI TR-02102-4): Flags deprecated ssh-rsa, ecdsa-sha2-nistp256, and SHA-1 KEX while checking for hybrid PQC key exchange (mlkem768x25519-sha256 in OpenSSH 9.9+ and [email protected]).
• OpenSSL & TLS Policies (openssl.cnf per BSI TR-02102-2): Checks runtime OpenSSL version (3.2 / 3.5+ PQC KEM readiness), MinProtocol = TLSv1.3, and hybrid Groups (X25519MLKEM768, SecP256r1MLKEM768).
• Local X.509 Certificates (.pem / .crt): Detects RSA < 3072-bit keys, legacy signature hashes (SHA-1, MD5), and exports a machine-readable CBOM CSV (--generate-cbom-csv) and JSON (--json-out) for ISO 27001 / BSI IT-Grundschutz audits.

Quickstart (Zero-Install One-Liner or pipx)

# Run directly via pipx and generate a local CBOM CSV + HTML Audit Report:
pipx run git+https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli.git --generate-cbom-csv

# Or run via curl (100% Python stdlib, read-only):
curl -sSL https://raw.githubusercontent.com/KenanErorr404/bsi-tr02102-pqc-audit-cli/main/bsi_pqc_check.py | python3 -

Drop-in Hardening Snippet (OpenSSH 9.9+ & OpenSSL 3.5+)

# /etc/ssh/sshd_config.d/10-bsi-tr02102-pqc.conf (BSI TR-02102-4 Hybrid-PQC)
KexAlgorithms mlkem768x25519-sha256,[email protected],curve25519-sha256,[email protected]
HostKeyAlgorithms [email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256
Ciphers [email protected],[email protected],[email protected]
MACs [email protected],[email protected]

⚡ 2. Free Interactive BSI PQC & NIS-2 Risk & Fine Calculator

Need to quantify your 2031 Compliance-Gap-Score and NIS-2 fine exposure (§ 60 BSIG) in 60 seconds?

👉 Launch the Client-Side BSI PQC & NIS-2 Calculator (pqc-nis2-rechner.html)

(100% local in-browser calculation, zero tracking cookies, instant protocol-by-protocol remediation roadmap).

📥 3. Free €0+ Starter Pack & Enterprise .xlsx Compliance Suite

For teams preparing for an external ISO 27001, BSI IT-Grundschutz, NIS-2 (§ 30 BSIG), or KRITIS audit:

• 🆓 Download the Free €0+ CSV Audit Sample & Quickstart Matrix (Community Edition) Includes BSI-Audit-Matrix-Leseprobe.csv (6 sample audit rows covering TLS 1.3, SSHv2, IPsec/IKEv2, and Secure SDLC) plus a 20% upgrade discount code (BSI2026PRO).
• 🔐 Get the Full BSI TR-02102-1 PQC & CBOM Enterprise Migration Toolkit (€49) Includes 9 production-ready enterprise files:
  1. BSI-TR-02102-CBOM-und-Risiko-Matrix-2031.xlsx (3-tab Excel workbook with live KPI formulas, 45-row CBOM inventory across TLS/SSH/IPsec/PKI/KMS/DB, and NIS-2 § 38 BSIG Sign-Off Log)
  2. Krypto-Inventar-PQC-2031.csv
  3. PQC-Migrationsplan-2026-2031.md
  4. Management-Vorlage-Haftungsfreistellung-BSIG38.html (Printable C-level resolution template for § 38 BSIG liability protection)
  5. Production drop-in configs for OpenSSH 9.9+, OpenSSL 3.5+, and Nginx TLS 1.3
  6. Automated GitHub Actions & GitLab CI CBOM audit pipelines (.yml)

📚 Further Reading (DE-Compliance-Kompass)

• BSI TR-02102-1 PQC Migration Guide 2026–2031
• BSI Smart Meter Gateway (TR-03109), KRITIS & IoT Cryptography 2026