Hey, anyone here enabled PQC on VPX based on SDX machines? I'm asking because of the load compared to non-PQC. The hardware SSL Chips on SDX aren't supporting PQC, so it's calculated a 100% based on CPU. SDX by default isn't packed with that much CPU's (compared to a VPX on vSphere where I can just put 16 vCPU for example) - so I'm just wondering if PQC will break some SDX designs because of not enough CPU on the appliance? The same is with MPX environments... 🙂 Happy to discuss

Sounds like your doing QA for free for Citrix, ask them to write a cheque to cover your efforts 😉

I did a successful crash of a VPX, switching to TLS 1.3 PQC SSL-Profile, 2 hours later NSPPE Crash 😄 Case is opened and I'm awaiting some statements regarding the future planning, 2029 PQC should be the new default and this could break some architectures 😕

On which firmware version did you see a crash? and VPX on SDX or on which platform?

@Julian Jakob What have you been using in terms of vSphere spec for a VPX running PQC? We're getting ready to build out new VPX FIPS instances on vSphere, but this environment usually only has about 100 concurrent users so we weren't sure how much resources to allocate.

It was a VPX (4 dedicated Cores and 20GB of RAM) on SDX. VPX Firmware is 14.1 72.61 and SDX (15000-50G) Firmware is 14.1 56.71 (we can't update because of a 50G Interface Bug on later Firmwares, Citrix will provide a future Firmware where the Interface issue is fixed) I think the SSL Card is crashing because it's trying to offload, but shouldn't - Hopefully it's because of the 56.71 Firmware of the SDX. Waiting for a statement from Citrix Support.

Been testing on a SDX 16000 with both 14.1-72.61 and 14.1-73.30, and the VPX running also running 14.1-72.61 and 14.1-73.30. And haven't see crashes.

Very interesting, thanks Anders. Will monitor the behaviour and still waiting for crash-analysis from Support.

PQC is a must if you truly care about security. On June 22, 2026, President Trump signed Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks,” accelerating the federal transition to post-quantum cryptography (PQC) 🔐. Key requirements: * Agencies: Designate PQC migration lead within 30 days; submit Migration Plan to OMB & National Cyber Director within 120 days 📅. * HVAs & high-impact systems: PQC for key establishment by Dec 31, 2030; digital signatures by Dec 31, 2031 🔑. * FAR Council: Rules requiring contractors to use NIST-approved PQC by Dec 31, 2030 🏗️. * NIST (with NSA/CISA): Ongoing guidance + Cryptographic Bill of Materials (CBOM) standard 📝. * Commerce/NIST: Pilot PQC on selected systems by end of 2027 🚀. Shortens prior 2035 target to counter “harvest now, decrypt later” threats 🛡️. Full official sources: https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/ https://www.whitehouse.gov/fact-sheets/2026/06/fact-sheet-president-donald-j-trump-secures-the-nation-against-advanced-cryptographic-attacks/ https://www.federalregister.gov/documents/2026/06/25/2026-12909/securing-the-nation-against-advanced-cryptographic-attacks NIST PQC FIPS standards: https://csrc.nist.gov/pubs/fips/203/final (FIPS 203 – ML-KEM) https://csrc.nist.gov/pubs/fips/204/final (FIPS 204 – ML-DSA) https://csrc.nist.gov/pubs/fips/205/final (FIPS 205 – SLH-DSA)

I think this is exactly my issue... As we not only switched to TLS 1.3 with PQC at the Frontend, also enabled TLS 1.3 for the Backend SSL Profile 😄 Will discuss with support tomorrow. Fixed Issue: