The Apparatus

Every lab script, container definition, Terraform configuration, runbook, ceremony tool and public transcript the book refers to — released under the Apache License 2.0, so that you can run it, change it, and ship it inside your own product.

In the first ten minutes

Parts I and II need nothing but Docker. The lab suite runs five self-contained experiments and serves the results as a web page; the Tomcat image proves that an unmodified application server can serve TLS meeting the full CNSA 2.0 profile on your own hardware:

docker build -f docker-labs/Dockerfile.tomcat -t pqc-tomcat .
docker run --rm pqc-tomcat verify
# Signature type: mldsa87 · Negotiated TLS1.3 group: MLKEM1024 · PASS=6 FAIL=0

Part III: the cloud certificate authority

With an AWS account and a signer that can produce a raw ML-DSA-87 signature — AWS KMS at a dollar a month is the measured low-cost option — the runbooks take you from an empty account to a verified post-quantum chain with its root in hardware, in the order the book did it, with the corrections the book made. The public artifacts of the book's own runs are committed: certificates, revocation lists, the issuing request, the fleet's certificates. With OpenSSL 3.5 you can verify the book's chain before you build your own.

Two rules

No secret is committed. Private keys, PIN files, environment files, Terraform state and database dumps are excluded; if you find one, it is a bug. EJBCA Community Edition is consumed unmodified, as the published container image identified by digest, under its LGPL terms; nothing from its source tree is in the repository and nothing in the repository is an EJBCA product.

Community and beyond

The apparatus is the community edition of what GreenPhysics does: everything the book shows, free. What the book does not show, because it does not yet exist as a product, is the machine — one apply that produces the authority, the ceremony and the fleet, with the custody backend as a variable. That is the engagement today and a product in its own right when it has a name.