SSL/TLS Orchestration and Post-Quantum Cryptography
What the domain tests
How you centralize TLS decryption and re-encryption for inspection, how you decide what not to decrypt, and how you plan cryptographic migration as post-quantum algorithms enter TLS.
Core rules
- SSL Orchestrator role. BIG-IP SSL Orchestrator terminates inbound or outbound TLS, classifies traffic, steers it through a chain of inspection services (inline L2/L3, ICAP, HTTP), then re-encrypts. Classification can use SNI, URL category, source, or destination, and bypass lists exist for legal, privacy and breakage reasons.
- Certificate hygiene. Serve a complete chain including intermediates, keep OCSP stapling working, automate renewal, and watch expiry and clock skew. Incomplete chains cause client failures that look like application errors.
- Inspection limits. TLS 1.3 and Encrypted Client Hello reduce what is visible; certificate-pinned applications break when decrypted, so they belong on a bypass list.
- Post-quantum. Harvest-now-decrypt-later makes key exchange the first priority. NIST standards are FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA); TLS 1.3 hybrid groups such as X25519MLKEM768 keep classical and quantum-safe exchange together. CNSA 2.0 sets migration milestones, with full transition later this decade into the next. Inventory algorithms and build crypto agility before swapping anything.
Worked example
Outbound inspection for a large workforce: classify by SNI and URL category, bypass banking and healthcare categories, send the remainder through IPS and DLP, and re-sign with an enterprise CA on the BIG-IP. Enable hybrid post-quantum key exchange on the client-facing listener so recorded sessions cannot be decrypted later, and note that signature migration (certificates to ML-DSA) is a separate, longer project than key exchange.
Traps that cost marks
Decrypting everything and ignoring privacy, performance and pinned clients. Believing post-quantum means replacing TLS 1.3 rather than adding algorithms to it. Treating key exchange and signature migration as one deadline. Forgetting bypass lists, and forgetting that missing intermediates cause failures long before expiry does.