Windows service 2025 AD CS - I am not able to create PQ CA based on ML-DSA

Tadeáš Janků 0 Reputation points
2026-08-31T12:19:28.7266667+00:00

Hello, I'd like to create a new CA based on PQ algorithm ML-DSA on the Windows Service 2025 server. I am using the version which you can see on the screen below. According to my information it should be sufficient enough to use the ML-DSA algorithm.

However, when I navigate through the steps in the AD CS configuration I am not able to choose the ML-DSA key from the options. What's also strange is that when I use the command in the CMD it suddenly works. Why can't I create the PQ CA from the GUI?

Thank you for your help

User's imageUser's imageUser's image

Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Tadeáš Janků 0 Reputation points
    2026-09-03T11:58:41.5633333+00:00

    Hello, I did a reainstalation and it suddenly shows the ML-DSA key as an option. I am not sure why it didn't work but thank you for your help.

    But I'd like to ask you one more question. As you can see in the picture, I can create ECDSA and RSA key within an nShield HSM, but this isn't an option for ML-DSA key. Why is it? And is it possible to have a PQ key inside a HSM? Thanky you for your answer.

    Kind regards, Tadeáš Janků

    User's image

    Was this answer helpful?

    0 comments
  2. Allan Solomon Mejia 7,585 Reputation points
    2026-08-31T16:17:20.8533333+00:00

    Hello @Tadeáš Janků

    Your Windows Server 2025 build is new enough, but there is an important distinction: ML-DSA support in AD CS requires Windows Server 2025 with the May 2026 security update (KB5087539) or later, and Microsoft’s documented ML-DSA CA deployment procedure isn't simply selecting ML-DSA from the traditional Server Manager AD CS configuration wizard.

    Microsoft now supports ML-DSA-44, ML-DSA-65, and ML-DSA-87 for newly deployed Root, Subordinate, Enterprise, and Standalone CAs. It also requires CNG Key Storage Providers; legacy CSPs aren't supported.

    So the fact that the command-line configuration works while the Server Manager wizard doesn't expose ML-DSA doesn't necessarily mean your OS lacks PQC support. Follow Microsoft's dedicated “Configure a certification authority to use ML-DSA” procedure rather than the conventional AD CS wizard.

    Also note that Microsoft explicitly states that an ML-DSA CA must be newly installed; you can't migrate an existing CA in place to ML-DSA.

    References:

    Microsoft - Configure a CA to use ML-DSA

    Microsoft - ML-DSA support in AD CS

    So don't troubleshoot the missing Server Manager selection as a cryptographic-provider failure yet. If Microsoft's documented ML-DSA command-line procedure succeeds, the underlying platform support is present; the GUI simply may not expose the new PQC configuration path.

    Help make this community better for everyone: if this answer resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.