Classical Acceptance Is Not Hybrid Authentication: Validation Policy and Lifecycle Management of Hybrid X.509 Certificates in Deployed Open-Source Stacks
Post-quantum migration relies on hybrid X.509 certificates, which carry post-quantum material alongside the classical so existing verifiers still work. Several designs place it where a verifier may ignore it, so the classical path decides. We tested eight open-source path-validation stacks over seven independent codebases, one in two builds: nine configurations over six certificate profiles. On their default paths, every stack that parsed a separable hybrid certificate accepted it. Invalidating the post-quantum evidence in each separable scheme, leaving the classical evidence valid, changed no verdict in any of the 27 cells: none distinguished sound post-quantum evidence from destroyed. Four stacks verify post-quantum signatures elsewhere on the same path, so immature support does not explain it. Two stacks implement the checks the schemes specify, neither on its default path, and no document defines the interface between them: one carrying a relying party's hybrid requirement, an operational policy, into path validation and reporting which kind of acceptance resulted. We contribute a specification-derived model, this test, and a policy-parametric contract pairing a policy input with a labelled result. Revoking a bound post-quantum certificate changes no verdict in any of the nine configurations, because none consults it; the labelled result makes it visible to operations.