PQ Crypto Surface Scanner

Overview

Harvest-now decrypt-later is already a planning problem for long-lived TLS. Operators need a crypto inventory of what their surface still speaks, where hybrid or classical-only stacks sit, and which hosts need remediation before PQC mandates land. Vendor blogs own the policy argument. This page owns the job: hosts in, TLS/PQC findings and CBOM-style rows out, on a schedule you can retest.

This is a standing check for exposure management. You point it at a domain you own (or feed a host list), run BHUSA 2026 Arsenal AC Scanner for TLS and post-quantum readiness signals, and get an evidence report with remediation hints and a retest delta when configs change.

It sits next to the library Full Subdomain Enumeration (inventory without crypto posture). This Collection unit is the Arsenal PQ path: subfinder and httpx expand a target domain, extract-hosts builds the scan list, AC Scanner fingerprints TLS/PQC, and report emits findings, inventory, cbom, and retest_delta. Demo default is cloudflare.com.

Pipeline

1. Seed · Target Domain(s) (eof-raw-data) supplies the target domain list (demo default cloudflare.com).
2. subfinder enumerates subdomains for those domains.
3. httpx probes for live hosts.
4. extract-hosts builds the host or host:port list for TLS scanning.
5. ac-scanner fingerprints TLS and post-quantum readiness on that list.
6. report turns the AC Scanner folder into findings, inventory, cbom, summary, and retest_delta outputs.

Inputs

• Target domain(s). Edit Seed · Target Domain(s) (eof-raw-data) for the full enum path.
• Host list (optional fast path). One host or host:port per line into AC Scanner hosts (or replace extract-hosts output) when you already have inventory and want to skip enum.
• AC Scanner. Private vault tool. Point it at your host list.

Outputs

• findings.jsonl. TLS/PQC findings with remediation hints.
• inventory.jsonl. Hosts observed in the run.
• cbom.jsonl. CBOM-style crypto component rows.
• summary.jsonl. Rollup for the report pass.
• retest_delta.jsonl. Schedule-as-diff scaffold when you re-run after TLS or cert changes.

Integrations

• subfinder
• httpx
• ac-scanner (BHUSA 2026 Arsenal)

Sample output

Sample shape from the report pack (illustrative, not a live KPI).

kind	title	remediation	component	note
finding	Classical-only TLS stack on host	Plan hybrid or PQC-capable TLS where data lifetime requires it	null	null
cbom	null	null	tls	CBOM-style crypto component row for inventory
retest_delta	null	null	null	Schedule re-runs to diff crypto posture when certs or edge configs change

FAQ

Is the default run safe to leave as-is?

The demo domain is cloudflare.com for a public shape check. For your estate, change Target Domain(s) to a domain you authorize, or feed your own host list. Do not point enum at third-party estates without authorization.

Do I need quantum hardware to use this?

No. The workflow inventories TLS and post-quantum readiness signals on live hosts. It does not require quantum hardware on your side.

Can I skip subdomain enum?

Yes. Build a host list and connect it to AC Scanner hosts (or replace extract-hosts). Use that when you already trust your inventory and want a faster TLS/PQC pass.

Why schedule this?

Report emits retest_delta.jsonl so a scheduled re-run can surface posture change when certificates, ciphers, or edge configs land. Monthly or after major TLS rollouts is a sensible floor.

Where is the AC Scanner tool page?

See ac-scanner. Upstream is QubitAC AC Scanner; on Trickest the node takes --host or --hosts and feeds the report stage.

Related workflows

• Full Subdomain Enumeration. Reach for this instead when you need inventory first and are not ready for TLS/PQC posture.
• Multi-Cloud Dangling DNS. Reach for this instead when the job is dangling cloud DNS, not crypto inventory.