DEV Community: KenanErorr404

BSI TR-03185 & CRA: How to Ship Security Patches Without Triggering Software Re-Certification

KenanErorr404 — Tue, 03 Nov 2026 20:36:26 +0000

Shipping rapid security updates, CVE hotfixes, and cryptographic library upgrades (such as OpenSSL 3.5 or wolfSSL PQC patches) in regulated software used to trigger a painful dilemma: Wait months for external re-certification, or ship immediately and risk compliance violations.

With BSI Technical Guideline TR-03185 (Secure Software Lifecycle), BSI TR-03161 (Healthcare / DiGA Applications), and the EU Cyber Resilience Act (CRA) reporting mandates that took effect in September 2026, the German Federal Office for Information Security (BSI) defined a clear engineering framework: Manufacturers can ship security patches without losing existing certifications — provided their release process follows a documented, risk-classified SDLC with automated SBOM evidence.

🛡️ 1. The 3-Tier Update Classification Matrix (BSI TR-03185)

To avoid full re-certification on every maintenance release, engineering and Regulatory Affairs teams must classify every change before merge/release:

Update Class	Definition & Scope	Re-Certification Required?	Required CI/CD Audit Evidence
Class A: Security & Crypto Patch	Dependency upgrades, CVE patches, cipher/TLS hardening without altering security architecture or external APIs.	No (Self-attestation per BSI TR-03185-2)	Automated SAST/SCA pass + CycloneDX SBOM (BSI TR-03183-2) + VEX status + Release Sign-Off Protocol
Class B: Minor Architectural / Feature Change	Adjustments to internal modules, non-critical UI/workflow changes, or updated sub-components.	Partial / Delta Review	Threat Model delta (STRIDE) + Regression test log + Updated SBOM
Class C: Major Functional / Security Boundary Change	New authentication flows, altered encryption architecture, new external attack surfaces, or core data-model changes.	Yes (Full audit / BfArM notification)	Complete security assessment + Penetration test + Full certification dossier

👉 Read the full German & EU technical deep-dive: BSI TR-03185: Software-Updates ohne Rezertifizierung & CRA-Compliance 2026

⚙️ 2. Automating BSI TR-03183-2 SBOM & Crypto Gates in GitHub Actions

Under BSI TR-03183-2 and the Cyber Resilience Act (CRA), every release artifact must be accompanied by a machine-readable Software Bill of Materials (SBOM) in CycloneDX or SPDX format, alongside cryptographic configuration verification:

name: BSI TR-03185 Release Gate & SBOM Evidence

on:
  release:
    types: [published]

jobs:
  tr03185-compliance-gate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Source
        uses: actions/checkout@v4

      - name: Generate CycloneDX SBOM (BSI TR-03183-2)
        run: |
          pipx run cyclonedx-py environment -o sbom-cyclonedx.json

      - name: Verify Host & Container Crypto Policy (BSI TR-02102-1)
        run: |
          curl -sSL https://raw.githubusercontent.com/KenanErorr404/bsi-tr02102-pqc-audit-cli/main/bsi_pqc_check.py | python3 - --json-out cbom-evidence.json

      - name: Archive Release Evidence Bundle
        uses: actions/upload-artifact@v4
        with:
          name: bsi-tr03185-release-evidence
          path: |
            sbom-cyclonedx.json
            cbom-evidence.json

📥 3. Download the Free `€0+` Audit Matrix Sample & Full `.xlsx` Toolkit

To save engineering leads, Product Security Officers (PSOs), and MedTech/DiGA teams weeks of manual documentation:

🆓 Download the Free €0+ BSI TR-02102 & TR-03185 Audit Sample & Quickstart Matrix (flcsb) Contains BSI-Audit-Matrix-Leseprobe.csv + README-Upgrade-auf-Enterprise-XLSX.md with a 20% discount code (BSI2026PRO) for the full enterprise suites.
🛡️ Get the Full BSI TR-03185 & DiGA TR-03161 Audit-Readiness-Pack (€49) Includes 5 turnkey enterprise assets:
1. BSI-TR-03185-und-DiGA-TR03161-Audit-Workbook.xlsx (3-tab Excel workbook with Executive Readiness Scoring Dashboard, Class A/B/C Patch Classification Matrix, and BfArM DiGA TR-03161 & TR-03183 SBOM Mapping)
2. TR-03185-Prozess-Audit-Matrix.csv (Machine-readable QMS/ISMS import)
3. SOP-Sicherer-Release-Prozess-TR03185.md (Full Standard Operating Procedure for engineering teams)
4. Checkliste-Update-Ohne-Rezertifizierung.html (Printable & digitally fillable release sign-off protocol for BfArM/BSI auditors)
5. ci-cd/tr03185-release-gate.yml (Production GitHub Actions workflow for CycloneDX SBOM & evidence bundling)

🔗 Related Open-Source Tools & Guides

Auditing OpenSSH, OpenSSL & X.509 for the 2031 Post-Quantum (BSI TR-02102-1 & NIS-2) Deadline with a Zero-Dependency Python CLI

KenanErorr404 — Tue, 03 Nov 2026 20:36:21 +0000

With the updated BSI Technical Guideline TR-02102-1 (Cryptographic Mechanisms: Recommendations and Key Lengths) and the NIS-2 Directive (§ 30 & § 38 BSIG) in Germany and the EU, DevSecOps engineers, CISOs, and Linux infrastructure teams face a hard regulatory deadline:

End of Classical Asymmetric Cryptography (2031 / 2035): Classical RSA-2048, Diffie-Hellman, and non-hybrid elliptic curve key exchanges (ECDH / X25519 alone) are being phased out by the end of 2031 due to "Store Now, Decrypt Later" (SNDL) risks. Hybrid Post-Quantum Cryptography (PQC) — specifically FIPS 203 (ML-KEM-768 / ML-KEM-1024) and FIPS 204 (ML-DSA) — is now required for long-lived confidential data (healthcare/DiGA, KRITIS, finance, public sector).
Mandatory Cryptographic Bill of Materials (CBOM) under NIS-2 (§ 30 Abs. 2 Nr. 8 BSIG): Regulated entities must maintain an auditable inventory of active cryptographic protocols, key lengths, and certificates, backed by personal C-level liability under § 38 BSIG.

To automate host-level verification without installing heavy agents, we built an open-source, zero-dependency Python CLI scanner (bsi_pqc_check.py) alongside an interactive browser calculator and audit workbooks.

🔍 1. Open-Source Linux CLI Scanner (`bsi-tr02102-pqc-audit-cli`)

GitHub Repository: 👉 github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli

bsi_pqc_check.py uses 100% Python Standard Library (stdlib) and inspects:

OpenSSH (sshd_config & Host Keys per BSI TR-02102-4): Flags deprecated ssh-rsa, ecdsa-sha2-nistp256, and SHA-1 KEX while checking for hybrid PQC key exchange (mlkem768x25519-sha256 in OpenSSH 9.9+ and sntrup761x25519-sha512@openssh.com).
OpenSSL & TLS Policies (openssl.cnf per BSI TR-02102-2): Checks runtime OpenSSL version (3.2 / 3.5+ PQC KEM readiness), MinProtocol = TLSv1.3, and hybrid Groups (X25519MLKEM768, SecP256r1MLKEM768).
Local X.509 Certificates (.pem / .crt): Detects RSA < 3072-bit keys, legacy signature hashes (SHA-1, MD5), and exports a machine-readable CBOM CSV (--generate-cbom-csv) and JSON (--json-out) for ISO 27001 / BSI IT-Grundschutz audits.

Quickstart (Zero-Install One-Liner or `pipx`)

# Run directly via pipx and generate a local CBOM CSV + HTML Audit Report:
pipx run git+https://github.com/KenanErorr404/bsi-tr02102-pqc-audit-cli.git --generate-cbom-csv

# Or run via curl (100% Python stdlib, read-only):
curl -sSL https://raw.githubusercontent.com/KenanErorr404/bsi-tr02102-pqc-audit-cli/main/bsi_pqc_check.py | python3 -

Drop-in Hardening Snippet (OpenSSH 9.9+ & OpenSSL 3.5+)

# /etc/ssh/sshd_config.d/10-bsi-tr02102-pqc.conf (BSI TR-02102-4 Hybrid-PQC)
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

⚡ 2. Free Interactive BSI PQC & NIS-2 Risk & Fine Calculator

Need to quantify your 2031 Compliance-Gap-Score and NIS-2 fine exposure (§ 60 BSIG) in 60 seconds?

👉 Launch the Client-Side BSI PQC & NIS-2 Calculator (pqc-nis2-rechner.html)

(100% local in-browser calculation, zero tracking cookies, instant protocol-by-protocol remediation roadmap).

📥 3. Free `€0+` Starter Pack & Enterprise `.xlsx` Compliance Suite

For teams preparing for an external ISO 27001, BSI IT-Grundschutz, NIS-2 (§ 30 BSIG), or KRITIS audit:

🆓 Download the Free €0+ CSV Audit Sample & Quickstart Matrix (Community Edition) Includes BSI-Audit-Matrix-Leseprobe.csv (6 sample audit rows covering TLS 1.3, SSHv2, IPsec/IKEv2, and Secure SDLC) plus a 20% upgrade discount code (BSI2026PRO).
🔐 Get the Full BSI TR-02102-1 PQC & CBOM Enterprise Migration Toolkit (€49) Includes 9 production-ready enterprise files:
1. BSI-TR-02102-CBOM-und-Risiko-Matrix-2031.xlsx (3-tab Excel workbook with live KPI formulas, 45-row CBOM inventory across TLS/SSH/IPsec/PKI/KMS/DB, and NIS-2 § 38 BSIG Sign-Off Log)
2. Krypto-Inventar-PQC-2031.csv
3. PQC-Migrationsplan-2026-2031.md
4. Management-Vorlage-Haftungsfreistellung-BSIG38.html (Printable C-level resolution template for § 38 BSIG liability protection)
5. Production drop-in configs for OpenSSH 9.9+, OpenSSL 3.5+, and Nginx TLS 1.3
6. Automated GitHub Actions & GitLab CI CBOM audit pipelines (.yml)