A Practical Approach for Post-Quantum Migration With Hybrid Clouds

The post-quantum migration for hybrid clouds is expected to be long, complex and resource-intensive, requiring organisations to inventory cryptographic assets, upgrade protocols, replace libraries and validate integrations across numerous systems.

A practical starting point is hybrid cloud architectures, where TLS between cloud and on‑premises often represents the channel most exposed to quantum-era threats, necessitating end-to-end quantum-safe encryption through support for post-quantum algorithms on both sides of the connection. According to OpenSSL, OpenSSL 3.5 introduced PQC support into TLS key exchanges, meaning some on‑premise TLS implementations can become quantum-safe with a single upgrade.

Some cloud vendors already provide PQ TLS functionality, while others have it on their roadmap, so a PQ TLS proxy may be required on the cloud side to achieve end-to-end protection. Practical steps include identifying on‑prem workloads that transmit data to the cloud, confirming vendor support for PQ algorithms or PQ TLS proxies, and upgrading OpenSSL to 3.5+ with careful runtime linkage checks.

The article, by Alex Zaslavsky, SafeLogic, published on 3 September 2025, also lists common on‑prem workloads such as Apache, NGINX, MongoDB, Redis, Cassandra, ScyllaDB, Oracle Database (partial), SQL Server (Linux) and MySQL as examples that rely on OpenSSL for TLS.