<?xml version="1.0" encoding="UTF-8"?>
<reference anchor="I-D.vicente-acme-pqc-agility-profile" target="https://datatracker.ietf.org/doc/html/draft-vicente-acme-pqc-agility-profile-05">
   <front>
      <title>Post-Quantum Cryptographic Agility Profile for ACME</title>
      <author initials="B." surname="Vicente" fullname="Brian Vicente">
         <organization>Sanctum SecOps LLC</organization>
      </author>
      <date month="September" day="12" year="2026" />
      <abstract>
	 <t>   This document defines an Automated Certificate Management Environment
   (ACME) [RFC8555] profile extension that enables ACME servers and
   clients to express per-account and per-order post-quantum
   cryptographic (PQC) posture.  The extension introduces a pqcAgility
   metadata object in the ACME directory, an optional pqcAgility member
   in order objects, and a server-side adequacy scoring mechanism that
   determines whether a given order satisfies an account&#x27;s declared PQC
   readiness threshold.

   The profile is designed for both public and private ACME deployments
   and does not modify the core ACME state machine: it adds discoverable
   capability metadata and per-order policy directives that servers MAY
   enforce.  Multi-tenant ACME servers MUST implement tenant-isolation
   controls that prevent cross-account PQC posture leakage.

   This document is distinguished from draft-giron-acme-pqcnegotiation
   [I-D.giron-acme-pqcnegotiation], which defines algorithm negotiation
   at the ACME protocol level.  This profile operates above the
   negotiation layer: it defines per-account posture scoring, adequacy
   thresholds, hybrid policy bits, rotation epoch anchoring, and tenant-
   isolation requirements that apply regardless of which negotiation
   mechanism is used.

	 </t>
      </abstract>
   </front>
   <seriesInfo name="Internet-Draft" value="draft-vicente-acme-pqc-agility-profile-05" />
   
</reference>
