A cryptographically relevant quantum computer would break RSA and ECC — the signatures under every certificate you operate. The standards (ML-KEM, ML-DSA, SLH-DSA) are finalised; the migration is now an engineering problem, and the deadline is set by “harvest now, decrypt later” attacks, not by when the computer arrives.
What actually breaks
Key exchange breaks retroactively: recorded TLS traffic becomes readable once the attacker can solve the discrete log. Signatures break only from the moment the computer exists — but certificate hierarchies take years to rotate, so the practical deadlines are closer than they look.
Hybrid deployments
The transition pattern is hybrid: classical + post-quantum combined, so security holds if either algorithm survives. TLS hybrid key exchange (X25519MLKEM768) is already deployed in major browsers; hybrid certificates are following through the IETF.
Inventory before algorithms
You cannot migrate what you cannot list. Build a cryptographic inventory: every CA, every certificate profile, every library pinned to an algorithm, every device with a burned-in root. The organisations that struggle will be the ones discovering hardcoded RSA-2048 in firmware in 2030.
A realistic timeline
Start with crypto-agility: make algorithms a configuration decision, not a code change. Then migrate TLS key exchange, then signatures, then the CA hierarchy itself — roots last, because they live longest.