PQC SSH Configuration

Ansible Automation Platform 2.7 supports PQC SSH connections from the control plane to managed nodes using hybrid ML-KEM key exchange (mlkem768x25519-sha256) on RHEL 9.8+ and RHEL 10.x managed nodes.

Before you begin

Prerequisites

  • Managed nodes running RHEL 9.8 or later
  • ML-DSA SSH key pairs (must be customer-generated)
  • DEFAULT:PQ crypto policy enabled on both AAP platform hosts and managed nodes

About this task

Verification

Run a job template against a managed node configured for PQC SSH:

# Check job output for PQC key exchange
# Look for: kex: algorithm: mlkem768x25519-sha256

Results

Expected behavior: Job completes successfully using the mlkem768x25519-sha256 hybrid ML-KEM key exchange algorithm.