diff --git a/certs/mldsa/README.txt b/certs/mldsa/README.txt
index a5a7e11a6d..34570edcb7 100644
--- a/certs/mldsa/README.txt
+++ b/certs/mldsa/README.txt
@@ -36,3 +36,31 @@ using OpenSSL 3.5+:
 Regenerating the private-key variants requires producing each of the
 PKCS#8 shape options explicitly; OpenSSL's default output is the
 seed-and-expanded form.
+
+Cross-level chain (tests that verification uses the verifying key's own
+ML-DSA level, not the leaf's):
+  mldsa87-ca-cert.pem / .der         self-signed ML-DSA-87 CA certificate
+  mldsa87-ca-key.pem                 CA private key (PEM, seed-and-expanded)
+  mldsa65-leaf87ca-cert.pem / .der   ML-DSA-65 leaf certificate signed by the
+                                      ML-DSA-87 CA above
+  mldsa65-leaf87ca-key.pem           leaf private key (PEM, seed-and-expanded)
+
+Generated with OpenSSL 3.5+:
+
+  openssl genpkey -algorithm ML-DSA-87 -out mldsa87-ca-key.pem
+  openssl req -x509 -new -key mldsa87-ca-key.pem -days 3650 \
+      -subj "/C=US/ST=Montana/L=Bozeman/O=wolfSSL/CN=ML-DSA-87 CA" \
+      -out mldsa87-ca-cert.pem
+
+  openssl genpkey -algorithm ML-DSA-65 -out mldsa65-leaf87ca-key.pem
+  openssl req -new -key mldsa65-leaf87ca-key.pem \
+      -subj "/C=US/ST=Montana/L=Bozeman/O=wolfSSL/CN=ML-DSA-65 leaf signed by ML-DSA-87" \
+      -out leaf.csr
+  openssl x509 -req -in leaf.csr -CA mldsa87-ca-cert.pem \
+      -CAkey mldsa87-ca-key.pem -CAcreateserial -days 3650 \
+      -out mldsa65-leaf87ca-cert.pem
+
+  openssl x509 -in mldsa87-ca-cert.pem -outform DER \
+      -out mldsa87-ca-cert.der
+  openssl x509 -in mldsa65-leaf87ca-cert.pem -outform DER \
+      -out mldsa65-leaf87ca-cert.der
diff --git a/certs/mldsa/include.am b/certs/mldsa/include.am
index cf6489f9ef..45c7120b9c 100644
--- a/certs/mldsa/include.am
+++ b/certs/mldsa/include.am
@@ -38,6 +38,12 @@ EXTRA_DIST += \
 		 certs/mldsa/mldsa87-key.der \
 		 certs/mldsa/mldsa87-cert.pem \
 		 certs/mldsa/mldsa87-cert.der \
+		 certs/mldsa/mldsa87-ca-key.pem \
+		 certs/mldsa/mldsa87-ca-cert.pem \
+		 certs/mldsa/mldsa87-ca-cert.der \
+		 certs/mldsa/mldsa65-leaf87ca-key.pem \
+		 certs/mldsa/mldsa65-leaf87ca-cert.pem \
+		 certs/mldsa/mldsa65-leaf87ca-cert.der \
 		 certs/mldsa/bench_mldsa_44_key.der \
 		 certs/mldsa/bench_mldsa_44_pubkey.der \
 		 certs/mldsa/bench_mldsa_65_key.der \
diff --git a/certs/mldsa/mldsa65-leaf87ca-cert.der b/certs/mldsa/mldsa65-leaf87ca-cert.der
new file mode 100644
index 0000000000..fb87ddfd37
Binary files /dev/null and b/certs/mldsa/mldsa65-leaf87ca-cert.der differ
diff --git a/certs/mldsa/mldsa65-leaf87ca-cert.pem b/certs/mldsa/mldsa65-leaf87ca-cert.pem
new file mode 100644
index 0000000000..c16d9feb86
--- /dev/null
+++ b/certs/mldsa/mldsa65-leaf87ca-cert.pem
@@ -0,0 +1,148 @@
+-----BEGIN CERTIFICATE-----
+MIIbOTCCCRCgAwIBAgIUMKLQIKlhl9TMackCFRxsAbkYNCkwCwYJYIZIAWUDBAMT
+MFoxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3pl
+bWFuMRAwDgYDVQQKDAd3b2xmU1NMMRUwEwYDVQQDDAxNTC1EU0EtODcgQ0EwHhcN
+MjYwNzA5MTk1ODU3WhcNMzYwNzA2MTk1ODU3WjBwMQswCQYDVQQGEwJVUzEQMA4G
+A1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQMA4GA1UECgwHd29sZlNT
+TDErMCkGA1UEAwwiTUwtRFNBLTY1IGxlYWYgc2lnbmVkIGJ5IE1MLURTQS04NzCC
+B7IwCwYJYIZIAWUDBAMSA4IHoQAGH0bY2WL94oVqXMYK1yn6nBL65/s1aLePQQpO
+4LLcL48a8GVAV5rX95UHHLjL1QXfZCAPSNzjxdF/lg39F5P2RcGRMQGLJ2taPa5R
+LWGvtaMN9ENBzdTMPoI5OTWKdo8858OvNPsiY83+ekggB+C9XAn2b8RUo0MrycFF
+aXEvyWRtAVJw07jJiptTPZpuNO8o9xmrGbYFpieKAQEkS0U9tOLzvZYpICK0gB7Q
+eo8ce7Mt6jqxWg2xqRiSiG6qbtBlNGEPdAJVadR4X0cHLPvv6gfkypnpPoDgJFJX
+eaQRdsKfNLjYdGRbjiaRPbWHEC81mOd0lTH8rppTs1AJZouL9cCf1GmndEpO03nh
+ESm/3rSHyyy/SUEPpT7mbiWqz9Wppkgp8kk2NqMNaWpgbrWgtsFb33inU+cQepH6
+CLLxbEiUWkAkd1K4Mnu7m9hakOBwbkW1lzZbP8oy3il6oMIYnCOc0HnittLqzQbd
+UGFW8W6+/MBV6xiWZE8lmGT0oed4n8dT35ZmsalBqoFinVXAU6TvM/6zvNkB2qLK
+ekUFCUEn4Ry8Yv/ajqlYzgcxsgEbvxm8lB7QznxAM2cCuO+AtX7G8kkpF18qttzP
+cofWgR7+9uMwqfIcnUnvubCHWhYE9qEXuT5xpKgshxOyrqc1/BohtPlSHoqZ+DgT
+5f1z48NxfVsuKTkCAaYYRAM+mwOCZfS/HDLt/49DTvZ30V0VsZF3NG17uOFeeA20
+4rj964XfjVDF3s57B4sbJb68W3GKwfQCoFohWCbe88Hy/lZTBDWnVCRHNcHXBctC
+XP/II5F3C6ziHctJXqg7O/wrR5kN7IaJelYmdF7Jggbehj3knbtdlSTK245y11ZK
+JT9CocjOfl7/tvKh9XrK1a/pEojBMHMIavTZUroaShiwfnC7BREcQZdhAzOvQMhJ
+D/sWSl9ejP+2PQi+Al0nrjxAGaAtmQgirNmQ96DmXEeRC0O554BFZc1LhZ/FJCdQ
+4ZVmSRB3EHkmjL/bDV/yOqXYQKWhEEsKtObQbImdOrT08oa8U2Im0mXsUitDP+yj
+vp6pzvixG9ht62P1MiLGeCArRvAA/D6cYrT89cZu2k1pe9AwAv9M7iQQZy64h4A3
+Ly/YqKnuh+GHLKvvWO2TP4OHkRNTlC9kVjXrtCvVGzH3XKGSJ38iXi1irOTs3T+g
+TvYwKwvLEbLwN4/B5LlBb1i2LRbY2QUNzwNmXBEAf7RmshlKB3nQBBKA7dsoNaq3
+UFCFHF3YV0n64EAhLJWkZLO5vqyEFoP9JKK6gXFJLf793xEzoPGCvVNyUBqvUzIC
+k/cNHWgkk3Bxxrw2qa9tpgUvo/AIqg4mer4CFGWpBVRms+gpvX1k8WeLxCP8qfiW
+iMirC0dVrol/7A4OfXt1kmL3uhF4pbxCeWjZBvT9b4r+K0bzcRG2UYML955aKYib
+FRnu9c3UIjVZYq/18S8O9ivugXtL7ottwy089XBC7W6crE7gvRAwMv/BhDq80h9G
+3oW6cDfvlCK5fdHAurNy/AX0afBEWJdpe2QbmwIVUr2rv8W/eFwQqKqgM6gMHtVU
+SPEj/cVAKV88YxRa3Q7ntoWqDEdGFzS1E6ts1hR+EIYwP3Kfc9JIPJ3TmGC6IyC7
+3Xa6bNFA3unDwkeEU0mZCR4iYCDLoKTy+9QQQc4fT6dBdeQ81tliRM69nMHzH5de
+mfVHBf3gvPhjtmsjG+Zm4rr4/eAuKjyNT6n/uqhJyQe72p+22bRlJthE2BIat3na
+CLYvLgkMDmZwlIPv0omvJth6qpHggUDUE37IrzLR1wEyUplYkqqsU0ZpgAcjSx26
+SstrX0fNA+MRAZzk8QVbLaHqx0cbC8KG5PPXcS2R3qNHdGecYWAzyATTd5ImN3Le
+cIGg7p9Cw4e1hky1tt08dZJMQQyCnKUYjeHZX+b4WNSP+MX3lrlz2DXTEmgUeKDR
+15TfcRIuPehGgxr6dh3lxBcrdZY9NGNcsgGJnn2qwEda2Ss+enMvzcrhbLsYSpcs
+hiUDv7ckZgfcSL9/gtGKYVh6WDmfT6VXWvNzpkZUOmTuPG3bF51oeCd7iPNaPTL5
+Amf6SzY07gK4s54YbXc3V4KtMraio6z3+BLafOeV00HT8aMKNFIMArmqgLUZvfGN
+/hkrRcLF4FBkxjtXrNNA5ptVOmQLxovzHMF9fvLwy8ELRH0ZRGqS5kDlt047Ckre
+tC8+vy9dBUBoDlWwImzvy3wZnnm0Q4UFxT5nuf/wPnn3JUSCh06dKty0Tui9EOp8
+4WQeZAEqahzdur9wIRTFbDjjinOV842Yg9v3Db8IOmSbp89rKadt3cBZB4wQs9VI
+Q3j6WlBnws62eXKMrl9MFAnIEL9LIy/DUd5fnbFn/G1KXBiyK9cQPunygHq2fvOg
+0P0GTc1IRsXuRNqjB6Mi8iEV5MciEvHaxHdhyUwkUIatHedYV7qlns+rFnP07XH9
+9R5lRoOQlPlfOdtFFUCENK2X+PvHmy5oQisBh5zBifEvcVln9HjOkbvkCwI+82RW
+EICfqjdyKnu8JgB57OxrgBb/nMRcd0S/N3KzilWWiVPQpiNaV5wMLzD7XNRy0q3W
+2+IEyaNCMEAwHQYDVR0OBBYEFBhmys7wV3j7u85h3qYNWvs2mUVuMB8GA1UdIwQY
+MBaAFHVFbpeJWj8ipCLfuwtAyA1nJ/ehMAsGCWCGSAFlAwQDEwOCEhQAHXk8O/n3
+mCdY50EySnQtMYwozzuB3pPCO4g4ph9z3R89DwF9amjBr3Oib4ax1nJFty39jsxJ
+AEbg3SqQfQobq1whIz/UKSvrpWKAW9Zj0TWDE/yY2TmHkGE6sjyF3WWbPwqUIKi1
+EOssN0MV3pj5Mddk+Ndj8aI1lYA1rA8Qji0fpugslZN3v3gzlczqgNPnNAlvGnsQ
+Drh1sO4g+E2w248V8rM+I6uPt1jBn8Ril5JSbQipSpYXTQuHhMamcR+frNJuyoR6
+vqth3MIt8VlqBMhG+60ZFBKxo/4VZeu/HQxQnbGnEYNgHNn1STF0OGfsNPliAUum
+i0F7hm8gQtexcfSo0jQy3jO52BBLYpw/JHVKGZpJscFXLYOAaNrat000G9mQyi9p
+OtXTjAQA5/6rzWl21QZtYEKeWok+p4GE+yV9U3cM8q5oYV6VkFQBj3lMig/WAazm
+luQaukgbhvr35GnPNTazsPThv+65IAWDO2Kjhy2aX6OmylS7UgmKuFwTig+bzSfP
+IALASJzzwKFx7sKKZi7x8pwyB31lzh1GNFLHb8Z8+dC5gklpEF8Gnu0Uof7xXbSU
+ecinmhTDSZvEkYcXaVfm1xAYQgMrjHbnf0tuJR/pquHAUYt9fd9HgZbhI/P88YE5
+POIwODWmrIGiLeNv3h+jDPe7JNLKvYSNyGZ/mNi3FXGqNtICGVGMjcSELQ7zNhT3
+Nv3vZ52B/b93dgryI2LJzmtvzDGKWnms8pZFx3hyE1m1BbGcTu0ryQaFNQOF73Cb
+5jHcg2ym/aIL+k7adS2/pZ6cP5yHvJfhxRU8LQOieA4KjkQYr4h38a/Ti/nGpyG4
+JeUR4rU+h02n6neslAC8YrfkjiYQIaRvevryNUNJxlxSziD6M/l6fMfSnsvFMXXg
+3uOjz3FbpT32W14COo4wk/R/ISqwBLv5H1a4gX+wtx4Xz5JpZhmLH7dQQngQfjsF
+6vwPcVUoPrsWKRpRc0Zb3XQEDL+67TiB1aJNr/xMDzwnbGUST8JBfFYe0WrMtdu7
+1nn2bPE2QmfR49Bm2xalcN8NywOebdmSBg1iaUdTDu9JYWyGGwG0G7EdqwPEqfC0
+2FONANEwy14oU7SLRhxMDbvANvKrxeiSc+bEigoxf6y6XKvFNhk7zzZrr1x5Zyts
+E9QJTHnqvAp9F+IDDsnNoJXHUEi2md0DIdNEFh0zVBNrIS/WhAJQ5A9Axmd3Au/o
+uGnCGnLGmSEiyIGIWxbx8pG+cPvEdZSXpuAyFOxOcG5lu2t9QsuPerTR1a6Zfqoh
+B2dmv+kKB39UbQPqFjcvXMclC1bETUwEGpDwhvLaBnKeb1QR4BjiTA1W8VbwJdUU
+va3KMJngsx/LmpN5q07/r3DPR65FAE5rLL1cUlDwz0S1ypnL61bCulgbAUhHfU5r
+jl6A5IMB7kLV8+JPqG+87ogpR28A96HWu06s/HoMAD0W3oKwjoar2vOBXhLOhdlk
+zzkSxOk4K6fLcMM1s21rb6aPEJT58qUDdW0gT6/oqLMM0paGaPOOj69deVlVyr0H
+xny8HxwjZNiEhjnqzHX+hm2tHkq1/cMXNC3lXGFrZ8S52tOFOkS3TfhKci+bePTq
+kef2p+HP0xY2ml11xgQBwqLShJxoyzjIIVmoZeHP59MGnGrs4zQgoyNPyQwRk8Wi
+mUI+gvP6oYPp+AglUS3oUFuA9qcMroPKBdF59V8uDYK3xj+TsoY6bWhgu3xTLEw6
+yXHEmbXCC/rzmtRobu8GWTVoODGD0MJKkWeOvHytWOf60O8ukNnMFpBQ3FZDZJGX
+zBA1cpy74lL8/PXdnXgI7J7K+8/WLX3mchZrsmDgij5Tldr92nH4RMG+v9rWlQiH
++VJduKnctOi8LEmj+/lyP3gXxec1BIBdIOPxaW8PXStUA9bXhHgpr95JDvwCZcrU
+A/fWQeaUaBEz2k94NbbdsLrHKjmRyHKA+JoIRlsEIfEkqRTBT6Eo9Pq8PGUGO3T2
+aI82mNugjSdImrZBUJLT/1jB8D+XMhdwZGoqt3jvUHpvB/oHpYFpkzzt4CsvE8jM
+bTFS50jB1uVjq9tN5EegCebyQtbfMwXeuDZ8dZgtGWPWiB6yZ98kdedQ8ufgvv8f
+vHrof3HKr5XIjBLWOi3k+WkcPWlY8yKg5yh10yEQ/DIEARUrMTmbONQNA+jWI/Fb
+v+zuR93gsUfm67uKJ1QaZRAuK2nqxkXBmdVSRLNw8hsUKdeMCwVJmMDxvOOj3wap
+/oh1d8Op3PRuy8AEKrmFxIfJnoBPXVqLMy6ffk/dc6y/KLtU/JV67mBtf/Toy6Ti
+3x/668oZJn+krotqaSO5bGcl+En7NrV7VW+OQ/vtirXlyKzGvp2ch0bY/yI6aH25
+hI01g/ulNbI8otZHTU9+/TgfamTBav3HFzLUEyojdKMVXMh9RrXAbO/jl6Z1trEr
+7NxQn6F5L3Syue0+zZ8SOb+M7+mHXORdIy6J0TKTqPiJXGnaEPYEIpJa6utVjgCF
+oYw4Z1kQMNGOvTGZj+aUld9iJvedAXp+4UWzh7GWWwguIGlar6o5tZ/QQG5gFTOI
+yR4gL2V+6++mUbPzgnkicM6tGY+n5Tqp6zXwoaCZlgEzLbra456Ik5T65r2WWJ2y
+qRAK6HERrQZifiN2X2Vurn2qiDhfiIvONarmNyuTI4Q9Q5ICOcLlV5GJr5iBmF8C
+ZnS4EwmLSn/UVcp+D8LYbjVoQp1cdcqUOPmD2tzY36YTqUnxUnzXevT1LPFa8bKH
+gfJ/4jF5TOq7ZSGA3oSUEDVYkRoLQIftjs0AsUEgmU5q7YWUqmRm2jQdlHXvnje0
+FpqmlKpUo8VeRlohgvf8VMW2kgFYQSIUqywMwCMJRWye4YPFc+MYVTIZpRd4ETGa
+XQra78UT9kggk9mN077f2dtmZXBrUmHN4+X3X+gNsfqj4EjSesxQC4LX9vjtupuH
+dX53tFXKeEPF+KDDBcS78uFHlYlkDWFJRlVq6Xw89uL7Ijfan5DYDcuDAcbYY2uH
+sPhMwltKpXWUN7/j1+VUoP6oCgTbjCRW02aXGJHItJILoCQ00QoTgHruFIR5JiQK
+3hUF2lv1KN9hLOkVmEdHKQO8l1xxZZgTzvrliSdA8VtD2efroxXA48I+dnt7G7yr
+9lIY6cL7xH+2w3JYqRHmhHRbMi+OvkgeO910HuaZBG66+WL4tlkyiHyBuI44SjnK
+vPnk7LpdAaZ2L3xYeDiFNyNg9cs4j3iCf2VxuOwqmgmr3M8DOfbRQ4/cgDHLLPYi
+Dwa0WxKAmOYyTmxDh9W1wvXrutUEfIYoaIdr3GARDLn8wXozNh+QSSZ4711VCR2q
+HyPCobdiXEs7qydBtAVogxRv20fOkFG93dtp/yHC0XBs9JLNCgwoTtXItPAoTXKT
+9XLiOiBcfoFuN9HooMwAdpVYWo71bCBXbv1eixweFOzCtgp1LSsSh8xVNpAzjb/i
+rOSBW6Ayk8ic3zBcE0aCJRHhEC+V1aVyAD6yKZz3gsvbCOB9gg3PAPxBBPjuKxNN
+Qwz41xNGrarkbnhXFlGgpk7Qnc5z87H7orVfxl3/OmNsOAXkj1H7c5+gIqw9ddsV
+ay48bq8dzBdxfJNReKka5F+J/p1Tu79JKhc2kGbKkaR9lI3SP3070f/UHAapv169
+ENkNQudbLxqfEgqoKUUbM7CuMmn0kB5wuUrPKe47OzzQL3aCB2vcNigkPBUP6yUf
+FiM2JW8aEqAoyraG007mmqG0o5OBR3s7ZefdURvU+lc/AglLDhQj/EKi/fthJuCa
+5+AuleTNKrzcXn8/ufxhVCkvEgNzdQwopXXP9PWKX5Yyo3/jKe/2Q+2tblHgb4C3
+AX/H8xoRSD2kycF2AJoK5weyn9/3KvCjmzpDLWDDiiAzrarY9onN/V8XFNTVQEe4
+2hknuUP2+hiU6fBjvbjVyxCgh+cWySc9bUD8nTroQhWEAyqXM2dQMQQY7o5CWvWo
+Gdh4aMCzjl2QJL+Wl5J7AR14yrwHO3Qe3zCPjn25zhb+qPSHPupXMGz6BnH045Ch
+dYlUeP2YHOqx+2J1a2VEBzpP3SP9knMmD/U13nkhYIDFgVhrCc8gLkk+/gH/fxp8
+U/IBSx4SZfUuC9MH+qMohcMrRvd4CVJglfFVRLt0hMMioAsL1BxaqRIShnwMAGIG
+GJqj+w0Mg2hzuxFXA/+K7FWs373KotgsAyVFAA3GDUP0Ml0JlwomRINT63koEv49
+PXUGln60IgUVQxFPHGo0UQM69E1jwUzkNiw+k2DwvrKbOMyCTQsVAS8TaPHLDLux
+N+SMmxcc84bNvfiiK6N6ilFj/Z5KTsJ11VY4zTz7tqjUMJeTLgKrcRz7oSDvTD0/
+lqixzvTUaDAP0mqfzKjV3WI5JXQouvX84Q3XDxGdidDrBuU+baQ3o1GuhVyQga9x
+bSUhC00muruoOKNaff4fKcpJgjYtkwbR2grCPG7w8CxE04Mb2O9Vh8Pd6As6r7Sa
+xCmtRCjPyKZn/iR1FsmkpRWi03p3M5RQVjnnqYfMpiUBE1jm5E6HYkENvxL7Luag
+4gxYCfXWXI6TRVq/qQFfmRtM4HzU3Xxt3lxB6qliE/omVNnKi6KwTYyioGZPBllD
+rv/02uxFfCbT/7IhG+XwBy6+hTfFVrSVTobHsyhPYuf7F/vt5lM+ctedGWRX+Y1y
+VeKx4Jz9ijBxfLNg/JE4TxZBCwVfbMVISr1bRbe7IZtKIJW8uhz/jty02HlCC3BV
+koDYiknMC1cqQuShci905iIkrkaFA6JkttAz4xOqxlZRiZVCVCfOnPT/ez7Rmxh6
+5yJCg3tUnEjpVmbjvFnSw1ve20Fg+6AA6wVmazcyfzw6b+hjMiheDzGwtwpS4mzN
+tUXvcf3PTY5C11Yp+GxGTUufdmBGA3VoBe6ITRE+iaolPIYBvXEVdtLfU6u7BfAR
+ruum8p/QMUuGOJNY7c4MJ92nHAjT/dB04EefzU8FwSKk2QPojC9wSL6Ltpu4hoe5
+Ci9ngP2B+KyRZUy0gWx5IvoKQX6GEbPoMF59+F3CdpmND2ABNyuMtYIEmVYZZjxi
+Mok3DM5yvtjS0iEaOuF5i7h/ZK1Gu6Qk4e+lDUlEmbKBO1BtjhIPHjVAQoEYKYu4
+RHx5DvrtpvT2JbK1qW0K2YnW+bVYd4wRd6GU2hkiKeSkqFcgk1jZSb/vTvyuGsiB
+5Z3qUdcNgH8x3DfvfEALM3lFI2gZyBLAPJVI6OQd9lWERSZkuqMIH7y9TAYi2E0A
+lJcRiA37gwutFP0Ak9/ir9xP/CNBqTasAndcRZkqDin+oNB4+Tb2afDNUstt5Eli
+o0Cek3/VkuBm84HxUWixngJlL1i2FJhLCeI9Pzq51JqWXIZtBmIa9uCUhIPQ4GtM
+oPF/ASdM8cqdh7wG5E9RxWr1QcuESYKCQEWx7Zt8STdEvqs8m6JtpS0TrZ2rX2+1
+UsF+nAYCX28NF34j7Og/IgRIO39Oj21BFJVJw7cYMXoN8TKFjg3c+QNeHKb1hV8/
+z676D7+GiGT6V0g21hMp+ld+QV0jxyINdmJ2hDJVbZgRNOreozSArKFE1W/igNLn
+ZsJH1gFQOOyuI15J3tM0paA+jAHaMpZWsxNgEMsy3slo86N/VJ/xdutM2BmKXecS
+MqJSwU0OlKTq8Ct6xoAQFbrM8DI25Aq+p++WvGx8lWGiDR4CUhI1y2Pj9D13SXip
+ezF0IH/8P4WVxtGui2HlIZ7buVO3ruTXwsAdhPuD6KqXn6/AFeFC5KIuVTk4YcwQ
+u65XmK7B0/PaSDNLjUBImIkSY34CCIqiBQzByFwHv7wLw59if47O0J0KTMhzn4SJ
+6lcskUoazxY6I+bqPicyLH4WmGqb69jn6FZnppMVsVYi5XUzYfxwf4FllZnulnf0
+5jVKN99OjWvjb7RpRlfn+n2HftAdn6dR9JWOPOm3638ELgYKtnTl2AylvvvO7dz7
+NKcMSOvGv60Crksr4mL3BUNeAXNHQiFSDoh885l4M1tAE7Aisu8si/yfQLWJ1y7W
+mZ38HY3ke7zaoTqRdgXEOjnmKf9RnP/cyggjP36Cz/oUlpims9ja3vgTJiwxg6q2
+zTd9sMHO1kxSaqHR0/f6/gU1YmN++PkQFD5wvNuWwu4AAAAAAAAAAAAAAAAAAAAA
+AAAAAAAGDxcdJi0zNg==
+-----END CERTIFICATE-----
diff --git a/certs/mldsa/mldsa65-leaf87ca-key.pem b/certs/mldsa/mldsa65-leaf87ca-key.pem
new file mode 100644
index 0000000000..585f2ed1e9
--- /dev/null
+++ b/certs/mldsa/mldsa65-leaf87ca-key.pem
@@ -0,0 +1,88 @@
+-----BEGIN PRIVATE KEY-----
+MIIP/gIBADALBglghkgBZQMEAxIEgg/qMIIP5gQg9bb8CKQdqJ8OGmW6U7tIxwC+
+SdcCmwZCMghe4+TbzTsEgg/ABh9G2Nli/eKFalzGCtcp+pwS+uf7NWi3j0EKTuCy
+3C/TZeexoTs0xJ/ax4gwC1W3ediBR7yoTtbeD2ealXnI5uIEr7f2dLK2HdqAPq/e
+Y4ljQ6SHPa1rGZeDqfFaLeimqGgzX10U/ti7eIzHKxG+9K2gYv9Zmtpbtr+mjHid
+Nc9gIRVBh0U2J2cihSiCZDUgYVaCBgAEYRRQMIEGE4hWFyKIQQQiUSB0hThUITgj
+VmYnYyg0VTgXgkdlgWB4QGKDIjQFQzRgVWUQE4gVAjZzdGYFh0NGYiZYUgB0BxhG
+MIhiI0UFFng4NmBhESZzMBQoA0AndDRxRGA3hiGCBngHdDByNYdQVRMEBTQ2c2dy
+dhJFYzCDBRZxFVEmYCh1VDCFJCBjJHZ1JmhWglR2ViSFcDQhNIAVAkYHAiA2BCMI
+YVCFhCdURFCGIwaCVYABNURxQTGAiFV0FlRDKGIzIBaFBTQoKEU4MxQndlEIQwYG
+iGRSU0IoEjeCJBR4RBYAUiNWAmJVOBGEgxAEcBSFhFN1CBAwhVQSGGRSiFd2dVFo
+UIUjKCJHNQVUgHMAAEBFQQgmKIcmURWAVXBCEyc2AkQBUHUmAoCFRVBHSHZod1hi
+FUdxBjRwB4h2QBhhciIiiFBwU0iGdzR0NERBYhAUYoY4ZmIRZBiAGEWFIgUoIWUY
+ZBJIIVJVNEaEh3EmhRR2AUMIcEhRQACDIDhyczWIeEVlMlcFZyQhZyIgUGODU1h2
+KAQ4WFNhcoc0UoJ2EIEhMkglMmNTNiBGIgFgRYKBaGZgQ2VkdHQVGHJoNnd0EzEn
+FjNmYnRiBVJ2YyUQdoU3hHIwhFRmFjNXWGBDgYGBUUIDMDMVFBWCFzMiNiEUdUdW
+JnFRYAIAKEcoFjExVRRUYDAANjBEUVGEBHAGR1IzhlIjZnCHYURzZ1CFSFhyMYJI
+RXMxVgVkODhlYCJkISBXZiEzIFg0RiV1Z0N1BWaDIDECcTgyIzVHA1aHMSQVIIYh
+UnODdCNgYVIxFVEoVYI0A0AIQoYBcUEiQSgVUChiQFhSIzVScCYINUBEVXYjYyA2
+Y2E2F3cIeDIhFIIkARUSN2UwhUdUAYNwAQhxNHRUgQYhdIBCKFNAdxJgGDMmMCcQ
+ITIYRQBFchc1gWWAU4JnBgaBhxcQhYaDRRY3AUAxUxVSdWGCUjAoKEITd0gmYFI3
+JlZCARglZFWDUABiBUIEY2ExNVEGgRYQdoVnFQFxBkKARjAoAIRFFXUUZEBCYgMk
+AzRREyEncSEHR2g0gDMoJoYzQQR0SIBUIAIAESYTRlCFJYJEQERCZCKBBnEiKERi
+FnZyEYYiIARYNyBlQWKHQFgIUlRBBGJXInJiEGaCF3QliIF0NySEeIB4NiSEMGQi
+N2hjYwJGZ2RzV3RwKEITNAZHJTYCOEZYckgwZQWBAhASFmhzYjdGMziBgoFwMHVY
+JCQxhjNYVVhUQkFgNhKEByUhYYQGiDR2eFEjYCBBMoZ2hAU1BABWF4c3chgUUmQk
+MnYHYiMxcyYiGCh0hDAyUDJUhQBRJyEQEHBWJDGBN1dhEUcHUBAgIGESEwFDdWV1
+ZgeCQTBTYkJTEzc1cXMoNgFVMhRHIBdiaCg1QBFxMVIzgHF0QYc3YkdzNniDEDCB
+OCIHZ2NmUENHVleAEQYoSDhARISBMhRgIAeFEmEHI0giAQNCMVAIIWeHExZoZjBQ
+SCViFjdVRHNlcVZDAoYTFSNSVmABYBNmdSNCdCWHQ2ARIHUzYiEzNVYRGBAnOAN2
+A0BYZxBxAmURiFUSaCRgJhU4OEFAERQIBwRASFZwEEgWBBUGJBQjNIdYN1MRIAUH
+EVYyFEZEMAg3YRKISEJ1FSIoRFhiWBZHVlaBUUhXcRAzOFYoCGcRQiUTGCMxcAZS
+UhYGQDAVECRQMQQ1iHViQTQRAAGFZUMyUgdwgyBGGAN2WIgABUQGRWNDY3IjICVo
+RhcHAYMSKBKEKIdDRUIHRAR1U2ERAQFgNRYYFlMhVlNlI3YRhYQBEWRoVVdkBUdk
+BUMwMjIAM2ODeEQFJGQwExBBHptYDUn9ALQD+B5xful7QsVQE40NSviJdHKiGAPR
+k85HLNr8ozqu//FynovfNl3F1RgPlNjYzp+pXXJOvVaHazjGlj9Y1ak9KQGUVJYL
+xFJvqEdoc0ixbC5Sc6KLyOIZAK+Ppw1uARlTZH+0CBBIaHvpCGFz4tDQLTX+vRlA
+16Ul27u66FZkKEVEuYzHo2fX0mbLtmCX5asHc5t72dyCoHwYl5gD2aAVvUr+cgvY
+yFQD5DXbr97RXzFmV/TT1JfS7PFlGq+X/jjUtg+0L6WKJ6CBDx1a4KBPyyxL2VhV
+AeOm3UPP99GOwkCI2FismwD9zUDfqpc6nLxRxaiAOcBtCOppL1VtGbZV7ISk3RK9
+I39hVHaGvbHeOSTbzAggadoM1wMp7/LA182AAVNQKU/ONMlEikuhgI+XV+en1tp7
+Lh5Hlm/sclkYOIMzNb0S0o+Ufyvl8noayM3FUJUGB1YVqjgSyZITj4I8zTUco9wX
+QGec2Bsmzl5D/4+0g5LmAChHo427Bf8Kv6HA26cuwJ2YWPXQqbfkhOTryiLs31VZ
+ppGM7o2Sn/s79q4DXnurLwKQvnzoAXMibtPbi/cZHovMVvBzV3aeOgJB0uQ6yaXK
+Lg8LXyEVE9c7/1ViS83z9lZ39mLvyJSJ1SGgpg2/4dlXlQ3XcUbO2g6kc0NkgnUx
+rjOzQT3C2126+9GgyBtmjv0OAh7n9aSIsvuutNiUB2/4nkV1KOefcWRcEFMt5WYn
+HwoDM7oO/ZDY6eEPJ/A9xVY5LxML7cjAyLlz7Cp/TXQBfg1bAaHF1xJe7MoPuEC8
+ru/xADgx1kid7zTE/e2FMk2uOwWp6JLZ+4YsRLpfjh3dgfPXc145lb4U1Nx79Qy4
+6mgQYJSV6FbwRvcRns6tACIDrvU8PKLUW8U3B+keuiIhzRBUUKvoVXu/cD9Ag2B/
+ijvl0BhZmDUZYrPrbTLVkThGwYy84hmdN3MH+GxOH9qHLgpu83Wlh2HFTCEfDSEa
+/75IQ/8iDAEFJZldKnL9B6jMPCj+aSpY/PbC9Pa4O6UXec92I2M4DRR1OQd4epev
+nT6jWvmenr5X2G6yyEUmhR6Fduh6GgVeJvNxE8CvLTW4PueTODOu17d/3lIPErKY
+Xn6Pu0rMrk8uEkhAlLUQfkU2XOVX4szfi/2OmpidZSQjo75POjo159o5dY12u3Eh
+3M5xho5qLUmMOmv+M7rQkXcj6uO5VZH/b2+txp+/1gMI78zfht0hJGZ0SjIaeSSx
+XsgRJyPS/OwGE7tkJrht3RFaBmEkzj+jbWoitpTESP6yZe8MSAYv/zcLwWYVWvFR
+3sPVJJBm8Yjo4LFt6z3vXu0aUrLXhIMThRCWKEnkJdrhL6jCr5uA3qMA0pzqjZgd
+sltKTnRdVG6t8lbxeQxfIRPzn8ijXa1vAn+sjLXlQcxdsleflYljQPHeHMYBEoHV
+5PilrnPANTcE/XWo0ZOd7MTO128WWmASAGYUs+L3aI0K+THV4DtRweuTjpWr1iHW
+VlTjPv5LYw+rQIUt/3Mk2XliRhzyq0C3i/KeWPplsdkUgDIJRHOCKFSSHeoxdq3i
+9uS3y26p0bJkMuRPrlto4t6f0yK+w+sWsXWSmQh1O8qdy2FVbOhM+pDXvUS6N9QC
+sGhq8PnFjbC77LC8F/EeA+3MEo4Y11wDJVC7bvGrZC6XBh6kV/8+nv+CMZ3X42Aj
+S/YXiE5YgjhrjnQ7GnIuzvOBWUQzXaifw6YcG38tSfcfng0Z+1YhhcjqhihwNdMj
+WzHyyN1RbsAoRwkRxnYpudhJc2Sfwhyn+R58dFhIZHr+D7XSRa1YNv/Me+ynjYll
+LwWkwETWp4INf5sY3k77L6531BhYLcmANnsEM56Cx9dVXC89Xlr7LQd4jMfnnaq3
+3T44zu3be6MN/LDR1qfTp27tTZUz0wQs1aX70eg5kaffUasLyAuqrsSWPbRWMfKq
+gMp6yhS14KY6Mhx0u79bHCjMFMDijA9QjTdchM2m18MM8A9dtoegekCCuDGGq/rp
+AD+lx3o5740J6XFm1mQkx/AMqViNpBgBEofOAkdwSQCffk1ToqL8j/cOKH7mUD9X
+hlKulhNK/5gU3Ks00CnX1883hJ+zKkn60/6frzVks8mD3xLbvG6Ze2JwBKoGlvha
+zxa3uDrqQwW8IUr2jW5Ozgc+SevieObaMTsVkUrCinAvUajNDF/yUB8/xYqTNzcW
++MsNZaaTVtAylX7DUk6E9LPqRsI6B5AMaHXztlrWifj4gXJdPqVY0pRE3QpUCCm/
+k//BvzD5wUIJyhjr928WzLL4RvsWlAO8ejeajiOaSkt0hBB2UBEeXjvtMnhXXCoQ
+Z4K10D2rjjSUAIrRgQL0sJjwvpnVllVRMSArbFw1nv8TguTADsNNTzX5jt95Vbkf
+2ibjI2nkWGaYef6YmtqJg/k18oQINI2ht707vbuBAPEQjhDGpxNOj7d9IphA3O2f
+42o9dhITGQ4Czna+xuiF76imVd/PvHH+sua2X8OWhPUDoSsPA7qBkroRdauTrgIC
+dFElJHXq9buZoTf67/qrfnQgLYFORAeNMxjU3aYWB0+17ndWLdTmPcJ+ZG01rQS7
+3JCnNSPHidjHhpcvhBVdeMxCuaVmPa759F4ivAtItIs5eJn4Ylcfip5MLG2CU7fd
+2FHvR007d3PyV3Cu5SeObecwUriLUK44ShFQr+d33uox2M6EF6tEt5O12J3q1Z8H
+mF82Fr6PwQ7ExmgsufhSJ1v3EzrXxa5UNF6FnOOJxMhKK0nS82vZfAbniNYUNr7T
+Yh2JasgK6ntmzmipQuMuEEb3QfkmJoRKjZimfSW+eAVWa/l8O8QTbCIGdMSg/NC/
+mJHJgzL79xfEqQNP0F6XJCYdurzpwFNk0uvOP67E4Ch81zquS1j7bBU6bQK3jDqC
+FklLmKdnNxTD0eKQqFkx027/nQ1zFwgjDk5w6ZowRECPDU5igVvL+0ct6GCjTjrd
+EPyiiy+Bpp5t2D8iuGty4ymsmFcjgqINTZlMkIFFOqsSde3gkKnwvljKQut8z42X
+/mlVAI6xCyP2Ghv3o5YrWGiBO1/HUUZRDXBzN+l1XRsHUO7T/UVrnth/NJfQ3281
+sbPXosfZfmPeBMHFm5mZSj63ehHb7LgHWVnyR428aokSGSJbQzfU2tyeQzahSSEL
+sT5yYjZeE2YVzbe9jl034XE9Kd1JSUXH9E/PFH5Es1bOozEUq1hvbtwkZJsLcFDJ
+XgdFwxZmqMDChioa/SUblSZV3WALGY9BnLpHag1LFUioYNCgo/BJFVA3Qo28veuM
+x3xEc8m8d3x3V/PaAHOF1QaA
+-----END PRIVATE KEY-----
diff --git a/certs/mldsa/mldsa87-ca-cert.der b/certs/mldsa/mldsa87-ca-cert.der
new file mode 100644
index 0000000000..64a4210ced
Binary files /dev/null and b/certs/mldsa/mldsa87-ca-cert.der differ
diff --git a/certs/mldsa/mldsa87-ca-cert.pem b/certs/mldsa/mldsa87-ca-cert.pem
new file mode 100644
index 0000000000..56e9a48806
--- /dev/null
+++ b/certs/mldsa/mldsa87-ca-cert.pem
@@ -0,0 +1,161 @@
+-----BEGIN CERTIFICATE-----
+MIIdtDCCC4ugAwIBAgIUb5z4PJr6qzF8bblJgpdmyYcdjDIwCwYJYIZIAWUDBAMT
+MFoxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3pl
+bWFuMRAwDgYDVQQKDAd3b2xmU1NMMRUwEwYDVQQDDAxNTC1EU0EtODcgQ0EwHhcN
+MjYwNzA5MTk1ODU3WhcNMzYwNzA2MTk1ODU3WjBaMQswCQYDVQQGEwJVUzEQMA4G
+A1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQMA4GA1UECgwHd29sZlNT
+TDEVMBMGA1UEAwwMTUwtRFNBLTg3IENBMIIKMjALBglghkgBZQMEAxMDggohADS4
+pq/7fJYXpK0yvXI95Vz7+bpPTJkto4WXqtZ7msVVV5fdHIO/Mnuc6iX9yoH8PGMH
+cvTM6INTpHaeP8rq/GtOvX76QFw8HVH4M0kH1yNiMU/g5mtRIHt0LUZhSqS6B5AW
+ZYygW9ZFwyFru3cvsO3yVEo4H/uwAWqu1zMkOAM4mQpDiO8MJ8K2u9ij5XENU5Ta
+FFHYHsJaVjG5EDlJTw5YJ3UL4ISfQr2nu4zr4ilNlyMWe/52xqbbSov06sO14af8
+U1CSyd8rKBPNod9+4701lC5Qbtrc6wsjIoEmSmQqmaWYAWsWSjg9JJ/RRLZVZDI8
+fOSv36GpFquroaDpc7i6SsBPhY+oNWzLUOwYABowIixLjVsDVbRz+lJ3hgHmFJhr
+wMk9HBi8TvV9uTgE4bwrNzDsWh89mLVuwDcY1VlCg0HWheyvUNZviffkA11IcVCs
+UA8/36x2SUuimv8K+qLDScdgG0I6KLjYlR83Q1VLK7y+iyiKCZ3KWz+91UKLEi48
+u1eZHapCpAMBp9PbaGrPIaC1Cw3Z2nBM7/3R3LpLZyKRDriptRWGPbvPUaZZqMek
+4iA3RDBtlNOpkR0aIwkqU9LMeBu4TPpwJ230rQhoFM69X2WNAmMYH7akd2ElEM1+
+L+Gq/4e9cQlmCxRDruurF3LD2YuZN7By/Lx4j0+8eCtXDzDBoQAK/9p8zVBV4iHZ
+cHqzF+AT47X6NwVmlHU2mOSzDGTpAkHtJdVei20dBfn/kHV0F8qOyHUWJBgL3HDc
+mXI6WxLp+dsBY8GC/MB0q66Sgo69eKH0MhlB4l6a1w1+ILBsfrTBjDZiytQv1dxY
+QMCkot6gMYfTjXhjmZZ6vGrAzve72Hv1ubDS0jeNxlKVMZJBV97CJrcjUiuu1V2m
+lvQ9kCJzOG7tD17nqyYztwoDV0fSt5VoGXA9i3RwRmBr6yF4CN44OcuWElIs/wcR
+/frXeY2LIWqP86ie8EZfHTUfd58jjfbomXBl+XSrUNzBemxxiEUwXVwJPHFBYcri
+KKv2JH/jIQyYIs5YwxIEUWCmWcQGVRbd1TCeOBLaHOBPx4NP5N0N0pfg0krh6yCt
+75JXjmAJ5SgcyrwjfZsYFVr4Sm5ybN1m/YO2uwn6wRs0Rz/1Bpo2+C+xk53fLWmn
+6bosEP3gp8w0EMZtpCRBeeFN2qEIFSNHmHy+NFumCa+dRd6nG4IZSbNxYIPhwMeD
+l5u8qxq/nKj+OzQymAXWSL1Yu8mPOPltwxvXFbqf8pmlA5R/jXytdFltqfjenxPW
+VdDNQDaVPX/wFKX00Q+ztj5R12LL+CIJ+O4+MmkMvm3SaQGoq7n8MmGrVF2et7rd
+SP1G5/Kekr1CXHQUaN1/rbNfha8DbSsULe9Y2iB3eKObHpWlpazlLvjy4lZ1YxzV
+/sOwqcVwDLVyoAzHv1xbfPuRGyXDDfeBXiJtFUapvCgAIVs5uaTDBv+HBx9QBWMn
+mpP+EaTZx2KO1uu1skx5U0NQIttV+R1jnjZT1PdXnBRBwVYOFxRcv4q71j3U3Lja
+XPQdOwKLT/O5lpXo6P83srSZYawBatnrwgCSZKhaAFCbhWKoin3iGhc9la++iIQt
+WhPD177GDaZbT35XCGNrGDYPux0vE0BPWSVXiE8X2b4J0MgwOqPUPG7+peEjq0z2
+bMsxi2dZzpYuDJM6+tMnkht/gzjgqUQmxr1P4t1fH/HJhLun4AzMzgxUh1lHHI5r
+F53DLq5l0eeRjqx12sQJ7fHqG3BAWKkxqZ4Ns1y6/sl26mlvbp+4/O+YdeAJF4YV
+ZplP20f/fw15SoK//iGicBPK7IErcaoeUERGMkalOZq73cGJUI8T9w+Bv6ezhR2v
+4O1oGt3HnnE9zKcItorKnhN7h06oDxGzKVNO5PDzfofB5VRXdF+KWvA0o09Zt2hP
+nSrLZSDYK5BOC3xPbt/dZmYNaj4A1CoQAEXdS5Q7dqsOxfTZy2qfkmJIZYNnIp4a
+rgttOY1d8ZNFSfJTerPfIDeoiDiBJtgcq4RnSYH9TZTXwZcZDoLYe1WyCc7r9BBI
+I7rJnKfkc2ymr9h5iApHOcW098YLt8TVKME7022ITe/tqIXVPW0tuL3EBRoN0DcO
+mXaGKv/7NKxqSfqqyigrxuD2MyHLnaau/JP/7IJVMmqaVidc1mLpmJ6s62sirLVk
+TKR4hubfR3STAQZFqgO0K1x3u6UeY7VU6446xhN/QAUIm2crVqyaYZN6Jsm2gH/b
+bKAFwdoah6jknKZkkiPzQhTobZizeyks6lnUXUhG/Jq0vCnX/x9ewE1P35orqx1q
+DLq8IqSE3+qO4HdWsCRCBbtawW5zMsy/ImV+yxq8fkzoQX4KxOxTCk8aLn5ERvnM
+QYd4b/XAidwBGq6hgz6Qz7Yho+ohsGPmvXbD1sZIaS+PTZq0B59ZWZcEyTcSFeut
+1rDk6RwhXYnyBizrOMyc0X41DkjaA7zsOL/M1zRNQ7MJhAIDuMTbAlUL3f7gh9ta
+850oHoK/f3pU8MLz6Hxx4U3E//w3aVYtLa6So768FxTiINS1bDmJO1KG9CwQr2vn
+mIyEUg5yYLINzN72FqfgFrNdjoR/+nu73VjLST/Af7Nk3/AmeXstqXOoaW5Ic3lB
+RE4nOsPkJsWn1isrECmCjxlvxAgziri8uMEiaI0hBN4kcK19Lk08hUw1IKZMoFhU
+UCb0PRAlhd1mybJxwvbprFfBcDDsl3Wx9SnV9GrwyQWawoDjcjNbv1aplXKHFnxq
+YsOd5FH7O+zwrKsju4NTVawXXRVFgn/a55x8IKpLcKQ4m4RDvqaD5xo5wq4/CRuc
+84ZdmbgXayJhrh4NjgFzaJfLOhQ+A90+0jQwsmsplvyRvCXFxRT1/+UOZ43QzVzz
+ThSGojH3SuFD5QpCigm9JOrVpSXND67e0HkFnTIpUk85AHHe9F6dwCukMh22sH8L
+FuA2b6TeaOEqE9JnhApFrRGqd3CxqlGSrzio01kQeAJOCohhVuXX2l60gikontg+
+nq1ldrpGfr6swDCrfman0VmOm+fwe/CSAfy9uxcadVAa3sFM5g5O8oOyl8Wkhh9X
+uI5x9B2ZFnCJJVkgE7rWfkwK7G6qGLy1g2joWd5p6c+69vdTSmyeIXr/XvDUwsBr
+U2xkquvYIhodKVkSB9t032nBpGGJ3pBX0o5o0Xi6YMYVSXofChvnF0qIKdnOSyCX
+IE8L3eOgEIIvpvESxNmh0yyMM/vtSEjbPZKBbVqBfgw4FKjZF3KUegNwnjj0mkdo
+jNoLEuNlNYqWzj4/Q97GxaLg3nx0H7HIg/ee3Io+qPVvtZRQb9jcJOmwRwVCqyOd
+/VmH9wsBPBsZZoGEA/H4lQ9Gk6LAWJllZF0qvAze4iAthxDdiZmsXUbGFFxV29P2
+6691xE/S+XqS1ZyQycbEiJ3cyozEGT9K3p0z31iaiWMCDEgw6qa095LztXUv06NT
+MFEwHQYDVR0OBBYEFHVFbpeJWj8ipCLfuwtAyA1nJ/ehMB8GA1UdIwQYMBaAFHVF
+bpeJWj8ipCLfuwtAyA1nJ/ehMA8GA1UdEwEB/wQFMAMBAf8wCwYJYIZIAWUDBAMT
+A4ISFADlRw5s/ZzMWs+VwQZJjzrtITgFLUwDflpoaeX+QOSHCShgIOC5ugBrUajT
+hC6+vZmsB3Nw51HfHdEkBu4Y5Adtg54CJKG5LjfBrWU/7YlbXEajvYqxG/FNNwNt
+rC4qYSolWSEfTx6BF7ObfQFcOmgGwlApis2gyqrlxXg5qg/vZ04i/KpqZeDp42Ee
+gK1Tc4LtJVGlpI4tt0nJAtLo4k7sEHoVTgXLHM9zcmf2lW7Kj1LGOPQa4UTWT5vV
+36GikT7v4foSGOyxJioHo8bu0PX5hQDSOjN57HW+iJqVAO+toN9z5uhdi6s+JvGw
+RkzElD/CZpEu++f3412pbW/mUr1mq6KFEeZdmUXPi4pJGE6XVqEybSrtUFaf55u5
+KxXS0+6aQmpm0h/ALkRNBcD2vEiZTUZClqin0Q67R3D4cAg8ou18gwfMoR+hJ03+
+We7CjSSqdWFuzkLp6HFfJv2IWWt8BTs5o5oIsVQFsCWEKXDobCc4NG3ttxPWmWkn
+pYCtDet+buTz6py7aPg7S//R26QfAZ8mg9MxP3IqynCGOUl+qd9opgiNeuZRGXkd
+r7kpoMXYVEx70+BBpfQksL9ZeF345rHWNjkgOWmnuc2E/9WvaRMoT5az+C2Ak4eV
+cIelzDKpf2UZhkSaqfZPPjfibNrQpsALc9qZnPJ1KQcZT9exKJgOtkG11ljQJRQI
+xcKkMDQVVCSKWEdE2r1qeMm6dw3krv6OHSzd9AXAuMuph1BqEVi6TevtGSY5HUzU
+ZEVAbFwF5SFahKq5RlNGgZx85DxUM0dYAHZsxmnnrnXNXfTZ7Kp/bp5RR+4+NAKt
+AzKRe69bIqe6zszlErtmO3kEarcN7ifQG480qnI5L7p+eGvkYJ8UWYHpOaZe0H+l
+if5uDNfgwUNpYoJmsRZHvtH01/phsskyAm/3K7NhGePXuw7tPtYsxE6GY7C8gYdO
+LmRDavCaPKfsjtX6a4K3uqA4YyV0Uzw4I/uUcePY4uymeU8Ce66NxakEOsUmirLF
+Il6TUsDRV/zfpukVTYnltN2ajFilRarXrXxgLb4W60jUV5Q8L8g25LTsvKmW6N0y
+QZ5f4jnuaIfDfBA44GbA+h0RhAK0HwJtjdDWHUX2qOvwf8EaFn+6ol58+zgADtu6
+RGLfKrbeyolnraPU7wvRfDug23zb4uX3hgNeWrjOOv3xXKjyuG7/Z/YHxYRwU8nQ
+m2IRg5aTqUjPkdwMRxHkL/v1AWULHG4MmddL5mQzRYg8J6tEV6obddDWB62XtHWS
+o32ME8zfgZ9zZ82n+J1gOYk+CFqNMMHQBWPaz9QmRQ+bzhV0W5F5hj6V4DzIjXti
+Ya3cchH45YhtgCFKYrQevMOjFVHqUj4VsnYy0qCbZoaTNmOrU4ANFFrhMjs++Jje
+wvEN5DPegS5vmfuK2rK0R67UkPE3o2+xVaPmETcAVTeRUsoLgKJDhhkUMNtW4/uw
+1/WCaRJCIhgrS7liemphhuDouPmIbNzC8zcCWnszrjilA8mkGZmLD92b68+tRpfG
+SfGLJ/oNGslJSgqwtzF1Cy+Ej8EJ1OV4oPhjXAwpYVXTjlDvhI/38sMyfWtYKFny
+S87Ps5qx66Zygnwz+pFfzib5xr4ntBlCQOEpTvBltozvolx1diBhIALj213psm4c
+7LSFl+H49inJGHlZmlF0DPr2R2UiKsKAVamUflwD2+pxIcYS8dbSXtEhuJo6Go2p
+vNd4q7JgObnfaHe7cKYsmhLT7LXB6SCfUehH8X6CqTqTOhspmYQ6iXZmTHeYqu5V
+sxgkcWfpvQyTE3tZLyeLF7yfyyqM0VghAVxr6JyNmXgC8/RGeOQnDETn2Ce+7Utx
+SUxMyYylfValWhmN+EUWIFDWPBFTF0fzGDH3MXMl7ek5rHnnNFV1FiPWtOqm3g4I
+Q19OdOho9XDJ5ahtY37qb+nI0VkNkPMtxIZR2Zyd14ruu6hw91FcujLvCWbi/Qse
+nK+HOLXtdXZKrxB/MShMz4MwetuZ6tgwXMFu9alDrO/qE62FhA/sycOe/jl5vHJk
+Ys9oG8j5DmNHk8ts4sA1gcv6iJm8k8ux54GDjx91MT74bKTYwLTRuORqY5QZb1bv
+9hkS4K0RXglGIy7zltUxSC/Kwsu8pw7pI83VHd5gQC61+lWnF0/XzKIikBUyulhY
+F2XECqvXKE+2/Er3TMfxY7bY8c8J7BHxwfl/E48qWAICQRcfkPMmd/Qc6D91gH/v
+t3v7AmALMAmD1U/JoIwEaU7bRPrDda+VcZZz/fKLZqeAiGKU/L+r8YiPHkA40hcv
+XCgNk7e/vFndjkYEx9jRNd3yI0Za2DH+xQUWuOGTLBPcnCkjdioJ9uwoiZ18mlML
+uGjzBlG6mSbHQcJpe9B/3wGoOEBo00SB2chsucNNsaUdwMcSyxn0KOwuFK84x0qk
+qktapOon5qJ7EFi0WoLcui/WCE1Z+932vYRvIYdoqHMnt/neJMTWQcHG8Fw+PuUW
+iU5k9Mccw7Kyaho5CtT4ppdzFKALeLJtwPMdR5A0heFAcjeRlgHD72yVR6O17Gae
+8ljxXZDV3NKh4ptoZxpg0yZhhoJZTxNxoz/waqNT99J8YO2pKeAKbGg2gf4zRk2k
+CGlVkqPbuyVT4omLn+t694tYis4JamROOKyi8F9G94Ki3nOwUMumYr7m+sa9veQW
+BIVtu41P9ut4m3j+kmOs97nHHXgMCPHtuG35xtQZKcALEyYBkQbz/fjkquqv7G50
+HMFoMFBIHu/I+uIAvJIiY/IiuCdP9BUotEIWLpimQfP8gERbThxheY995ZR6rgdq
+kKIdVmWyMjU1p0IeCUcWNVmTxUyEtRz2UNnJtraxjh3iVzu1eYpH/3UN++5UUmMd
+2S01RaOM0n36SaoAimRLcf0++PsRmG52uFlJQDu3CSpWFc/JK2WWqqBe+pSKgIQu
+nQkIAk2pn2YbeWtN0kj1b2Qom3aE87AZXpRHT8kpNN6OyWqBsyW0gWi7f5bHrJy0
+n3N8jovciiOYqqE0oiDk2topHrViHdb0DUVhZ3skraPBkNcwPbdXaLDhJgxaiN9b
+sPbzrgDqhFlSzmM272dsPJMOkp7u9TgOLxE6CuZ8u9oRWV0phYNna1J/Ds0sUHtT
+Ne0f9zxw8BHuc2fmz9jBtYJIt7G7pNAX410zJaBvJ7Zqdqay55Bn+FfeJVK2YBRp
+3EzU1x+TjA8FlO9wpQIwqdIpRjGlrFECv+Kc4/8CGc2rFfm4Ejcfqh65evwGYCKc
+cbWrelp7i194mjNUMT+ti/mMVlgLwPf5PBFWUSE/vytGetfqrxHmoh+tHNkkynX8
+LcFwNUHHBAjr8XubnH1oP/6+fMzoGEVUSGpsRSc4sJv9hPUHVXxCwuq5axeuKmoZ
+mtPAztojj78rwEk6PTW1Sn+D+vGkv4BKN+qlbtWpb903iWyHOpkZt4p++tXosgrC
+ZMRcU1buURnRAED4IXiWWGbIAjF/KE+J9N45TM1m1Z6T0IOQYt79tTRnC46qB/1r
+5uhRj+xL/GwbHSZFlGrCQsiCFtC9LobUZ9uGTrPiiAzA1vpTrusPm7p/Fxq5TMjk
+UYhKPx2/s/lHCPtlRvKCPoDKm4hyJGfqDBW+9iid9mdmXUQX/GQZaYjjXOF1uuf4
+VR5DpKV8VGaFyltFZiFekamw3dDsUtgy/J6M5BXWZUVeE/ehVCdm9m5xBgnk5kJG
+wjizPXkvcmdoXbchzj3TScZHiznByqDv5EYpn4IbBMJwa1VO6hZ7xQTH9m5dLATQ
+rlega12FMtGOFei2kjHQEJYxTtMxkQyAHs89Fq7UxgNWP7+XLUlIsW3S7b4KnXPj
+ltYlW8Ppq9IJNK56dGWIv3UWWu9CMUuRwPxsLRWGj0QetbbiAda6+OBUDjPG18eu
+n0T1/nlIYUV0DPqGU+hsxGcydcZRRjxrHopuAhvQhFOGQzS0pnIIkC+tt3EUYKMb
+wNJlg40QuuZqFRdsoDjY1MJOjmru3qTCVsTVg6DkoEi5U+onzJvRwxxOljF3mZGO
+aUYPibZ19jMoBCWzcJyTSbS16dd3PY76NBhX7xKhSzxj0coASmT9nzBltTMRw1hM
+q96jAT0j2/xVH5FFNWkQv4pasScksvKWmN7X7HX4WkR1FsDaHgb+WCUIKB2C9q1K
+QvFmPJIliSFLZwW5mfMHU7v/4MR1wojbVzjIT5K+bbYJRjskg2P/hTIXVGlrJKQt
+VR8MuZavFe9UxcGgubKxDmdm8RqIAhwK6dw0P5UH0dqiX2t2DWoFijDDGs586k4A
+Exx36wGUxSUFFNxFQM3z9XHJ9JIeyIU923pkp9dRpv7Yd8X7STYjP0jDwaaHJ0cG
++NvRQXM6aPAcR25v0ME0mRC6uwBCDPx3WY4yDC9e2IiWT3RkHM2NMQOi+ihpg0j9
+1Cx3qcsIoni8x3jtBamnmG4TdCxqlpQHvLYMLObr9mNINT2UY4ZeB8zVXuh4xUDU
+LxRVy1/ahqVPFTiXaqIoaR/dVB5GV+g+MXtuacRmCteWKWWUxMep4jbxKxNbkCV1
+B6ZyhE8BpZC+uyGEoibEAZI/Ex9dHmb7lvFfxWM/7vmGbVlhBsd/rimC6JDQxy/y
+qKZcKLx10zIQpWlFWn07ZjGnL5I37e/O8GMo2gNYnsssjEHIkuZ2X/rWHxYhbC30
+Zwopt8S7A5wybzOtenYbRK8NcDd9cb/nUVsaIGTIAEAtmeO1WxiCs/mcvMq15ifk
+8M/XUHBbWX2teaVloqGZw+0IMGjlSY8e8yN5Nm82pe6E5sPsf8T1ignhEhYPhc/D
+evxVb/CnSBiAgTi6eW8jp+ydxXcGijtKoXosoqty17BtMdcZ8zMlU+2XOz3jlCNF
+ZsD4Ys01sd6H03g68U97mj2S2SEAjY34AHd9IT0wwGslGC+0IM7msrylzl1Egjwa
+k7PvZmfuiXNYT3w0tu+uL1lR4ceNwVUdZ7gYmpgLPL+zrO0oyLhTxnTSs7GpD19M
+Ihjy0EH7nXdiA0aUcwumMBN3TEKIHdfjczHpLrZUBRRgLxouNjjTr4Pjpoi4HvGc
+laZUCoE88/fJsxMwCz8smZoRNDrj3GI7ulTw1CVNZAXrcfUG4uCFPRbloJrgmwur
+43GYQFOJN6SMYJIbMjnhUYCYGRhJk7VNiQHeXZ6bQVOckWeh/zvTsjxNMUJcDeWS
+ubd5qSZ5zX8gcLL0WmqM6PSJtSJi1EK43OJh+Di2UflFMS4NZigVEHExMDfDBsyi
+MasVakfMwGAxUKDd8PHkk6sPr0W5RsDanD39gTWxpQOzp/q9QK8hZKTCGx6r49ZQ
+mON+AduivwNWNyYIicL/oIoICDBc35ajU2IEE7/2l0LvNBmN9Gbs4bWTdrlCUEFp
+pGuoT9pqBK/XubOwWS6z03+hg0KqV9Mtha16gF7deuDpZ8J2dGJfbJgJmUnNMx6w
+v/aSupkzy6r+tfk3spcw4lgPLqzUgtylEAG2UcVNlxOyJDAqrIj20Hg84xZFiupx
+spaCbSYhXdAZBe1gPrptzwcfBr0nlSEqwLiTLDOGn2vUUeaQaAe2vNYm7khvki/x
+uIflLbXCbQnFSHTAGos8+cblpI+0IH+Eixilq8X8UIZud+ebw3mDSU5Naa9hx/YT
+3TRNCTrHgLzLeqhzE1qPWlZx+/PjyebRs7+ByByg9iVMMQsD5RlN0yZJd+wReuA/
+7gMg3QwOCFiLGVH6o+qWv9CCBlT12X1Yr6t1c3TWZH3vhmBcXu7+WMDuqo/0Z5Ny
+IUK74IBynkPYmjgMMiWRVMlh5QqScf8xID2kogngTqhple+XrWs6siysvm8F+pRd
+Rj/j4UzlyMLk2E02JAXv8rD68VNgGJZKp3MXG2wxPY6j649tbI9IX8gGLKEG1jXd
+mVlRbq/r0LYA1uitnD5Blv2uFy//lW5911OpW1P8HMungFEpYVb3MU6ZRjAMHwWV
+K/3FxiLQ5txBszIQZHp094RjuoS6cwHmsK4UD3v8stR/6+ntdXd6wYTpmc9T0d3o
+Wewj8VtCjo5NxJ5ZPM8mgDo55SVZ1aP9ZJMNZBm6AkQAODtjaw8QLThgZn6jpqq5
+5OwFCkJRdaO68QoTXHZ+qrm73CE0ceoeKIqVouQBGU6WmKG74Obn7/kkPlpgYYuZ
+p8re7w8rWnyZwcn3AAAAAA0VHiIoND9H
+-----END CERTIFICATE-----
diff --git a/certs/mldsa/mldsa87-ca-key.pem b/certs/mldsa/mldsa87-ca-key.pem
new file mode 100644
index 0000000000..e9c71950c0
--- /dev/null
+++ b/certs/mldsa/mldsa87-ca-key.pem
@@ -0,0 +1,106 @@
+-----BEGIN PRIVATE KEY-----
+MIITXgIBADALBglghkgBZQMEAxMEghNKMIITRgQgNwwCTHkiSBC/rF+Ih7Ekdxtw
+Xw6CF4GRCESneC+sQ0EEghMgNLimr/t8lhekrTK9cj3lXPv5uk9MmS2jhZeq1nua
+xVXvvrYJ/wP981HQhs2+flwkND3b/pM/uzqsrF2VF8rVQFQS8FLJmeQxZPAJdJHr
+8yh2hRC3FGhmExtAVSF+OHCtBD/gYPvYaBQoH6gDtLATNsRG/KzE74RyA0dUVqNa
+xVBAMCwSJSAYQwQQEQ4ZQGmiEGkBQEiDMDEkEg0SpmkiAQUahUWItggQxzDYojAK
+tgGjRAXCIFEZtWUMsZARCIYCyQiEEowhwwmYFnJUqImaRHFChAASNmyKMG3bAoDk
+RlAElymBSAXJBIjUoInAKEAJSYJcQmgENI0TtkyAqHDDmG3ClJChOGTJmAUJQELg
+EEAZhQzMFg1AAmgCRS7TQIrIJkQgFWgKk40TMgkaNo7MoIUIwSkQRkoElGwjmQ2L
+EGwQlgwRIwHTIgEkiUkIM2IcCGVKpCkQOG0ZAQYThU0LFywcAE2SpmDiNFEQxSWQ
+hgmMEIYURGDKJBLMFmYSIyEioowMtnFMqIQYRSWQpk2ENiAJo00EgW3LECDUEE3I
+knAJEkZZEmCcOHBCIATLSCLQIIQZEE5BwgEJqQUhoGVgkGnJOBGDMJJkIm5aQg7B
+sghJCFHQMIbRAGZBGC4KsojJtkgQuUWBhlHYGGaBBGmRQEoQh2yLCDGEAC5gBHAM
+iWXDRIWQNEUTiGyLBIWYuCSMKGkYoGQkGQ0IQYIcGQYCxknMtE0ahokBw03TxlFZ
+tIhUNiWAgoDjJAaZFjAIOAWSkjEaRYkEAoIZk0UbwJHDEkIAJVLBQEUDMIjQkkCA
+RiCguIlQgCgSkUmTEmqjAEwcA5JhyJFAFmmKMoQcRnIbRnAAMGxMphATgUURqSUh
+sWgZwWyDFA4AAXAZlS0jpHEjo03KIi6kMCnRSAWcki3DgkngEmYMsk0amWFQkGDY
+yIgQwg0Lh4mhQArcMoWJyCQbhoxAlAnMCCkJJwgggmWkQm3YBISjkGDDIE4JJiDb
+lGEZuHFTJAFjFBHSko0iSWpaMExamHHbJIIhw0EUqRHMJDIbwYhBpogEB4yUliQg
+SUZbEHHTgBBkJiLSAoWQCCRLQClEFgTTFgykyGHRKGajNkUToFDENo4iQQALGVKM
+EoDaRmacgEAUyERUOIBEBI6RCDBaFHIUsm3jQCXaGHHcIjHMhAkcyJEjFUyEACbD
+gkGSImjCEEobFCgkkFCMyCwDJFDSIgoiMIwYNGYaNEHQJgVcwCXbFJESSS1jRIkM
+lpEKBmJbEGLhGC0ixixQIkgBKWoAxClCOBKCmG0IlomSxEBMuIVEGEhZFIojNmHD
+EoTAoG1gtoAaswkQwiQMJGBZQmEUsxBKEGojFSWCBDEJkAyjsowIpiTShjFYyCQc
+xEiTIBIgokQJl0xSEkVQNFBEAI0SQAKIBk7YIknSRiFKmBACM2zatg1ZMkkQAw0Y
+Fy1QJm5IRoBJuESDxiQYKZHhJo4USCmAwgiDIG5UqGmTAlHbGETbFErgFIFaRIwL
+kTCTMkyDgCjMuARcoBBcmAWiBIkEMSiSEogKEoqMSFFIOIzZwo2iiIFQQFGCJABD
+OI6JAmSUMALZII6MFgSgElKUIELckCwclygTiFBYhkSDBiWTMIFaogQZBUjhtiiU
+hEHYsIljIo0Mk1HSAiEcwnGRIoYbkSQUNkISIDIEwmkJmEBElmEgxk2bJImhFkYM
+JAQEkFEMAlFkloTIQgoStRAYBjCkNo7jhIXLwJEQMUCbok0MNYrUNm3YwEzgRHDS
+IE4MCS4MN2yRIiKAgG1IqETTIkGTKAAcQmwExCEbxUVgFkETx1GDJJJCFgEaAmVK
+NEDCuExRBIFLKG4JImqCoGUJgGwhFAIRMyxbsGkERmGkpHDUAAYQRA0cEYrEMIoR
+g3HMAmJSJikjhIEENoJBCEzCBGjZMILhmIAMFmUQCZERlEXRKEgCIQUiqVFkxGWY
+EmkSSSHiJELEuIURJwARAIEjBmyARi5KIinhJiwko2ghsEBYJkYCCVDLNooIlQyT
+GBKYIG2RsGAJR0GAQEAJRWSZMG4AIGWhMIRSJkSkokCUMCqDOAWTqEjZBGEgOGJY
+IoHXZHX99Z4b8p4pEdb+5f8CufKCCfHv344dfH0KXiUb9NUOgCsqh9ijL430FxSJ
+Oky6UZWG27+6SzuaOf4IzRyQPAP28pVtQxVtiUZ0iYfWAhQoGBOTDqTim6CgFpVS
+BphdTBwdyuE3gbwbaDgNGVDFSovoHxs6YcoKG3C8ECF29kSgCn6xXKs0FYjxHqwU
+RZFYaGou2mNvhw3UKHDL94hVU7feZVeiQ8dHTI3c0OqlzYj1r2hLPd1J0Fl5Z1+7
+2j2Ahqz0E4zAsZXP5ZZL+b1FCUIbpd+S+6rrZXYuMgHw/sEkIdRpiO41kebdHZR6
+uojohwBnep5+NBiXx5Rk7RybYa6hGZswTdTGIdqJBc/EFDV7LLqOV4i385OPBvtZ
+VRs5ZFFSZMEF0LoGwyiZ9P0Dm15WL43WSMvdR726f4AbSnEPW6NJmOIje9+eyPHD
+dhXkQyw37t3n07io2/DMJIHQR90jE1F7zIrt7cn5JP/H0rvINisswwU0sot/ZyjN
+Ud6wf8fuMqvMM0UO8d9S7B9YRXPUsUwlgWlUTHFugpREMW4AbfNyUC84WUBgXmPg
+qs3KBsJTVG/JNGDXQXmh+0NGF+QMJGnpbS+T0I2PaRNmf3jhW5aEcXj1gSP+QFqg
+kYm8xUa9DH+vyKQaxfEbtkr8CB3QkMcnH4IJfdWaJAFegPRsjJpgrvGBjqK30TEC
+2z8RVsQlCe3wjtDxA7vhKiTR+xTPUCPV1n5/MUxL+FglCQVzmZ3jgUK2K0o0EXr9
+cJXaAK/9cHaKC6yoGTmuVA8aQXhzdR8lsEUDdRIWcJFYSvZs8TyXGeX2BkaJHOeh
+gnxnMZZKrD5djknj0UaE1jYvTem35vhspx/WT+keUwN9KCsu14Lgb3Q40iXWGjFU
+fwc/Lun8BX3ED+Opl0KUibANR2RyncnNUkikBUntB8ZbkqhEuyc/4mnp5WkEdhxw
+43ouco+W+qUo3nPk3ACSX7zmUzfbUPqC8Wq6JXv+gjryd0uf3RbFy+bOw5iT5qO/
+qZ/gZ1AVnzp+yIxvussVLFUhuZcz/x2UpWz1MTvZM+/dDRmeLSrvgqmFgRturSRD
+I+8gisn3d2sSAOLmN1bsYLwr7fqx2PyIKDPj7xskbBIMPYW1z1iutvO/U1qLsHJH
+lWD1gcV3AwE3KrIkS0U/gsYTeAzG3Z2Klrr9XxjKUvAFn9CcdYpFuqvBAx9MsVFQ
+2wUGXH6FM0QdnhxJvqiRGTtzbusC1OKI0vLFLbAe25Ot7plUaeCFoCMgypQmUoJS
+d45XWMdYqtYNjisxQo+yDc92Vo0aR54h58VCbGrQnh2ti/k4CpIf317LreMtajpk
+QT4613jkPzuGvointMj9VD6qgnewYzRrMofAlOiMg608nj45Hst5HlUlTpw6ti/A
+uLXUM6249ldE03OmCy/Mc/opl9S4KP60rRJtl6GNdW7ALgvWAMqtmyJ/b+Pd/Iz5
+ShX8mM+plBrCyGAAPdVNajox4t0jCz+7vMriJoFKH4/yxbcCZd7iNRL+vh1yfDIk
+JV7tqy1IIFjadeEUQeXo/C7tiTsurZvzFTULx1uIplfUN2ZqpIXfSaCgs033Gbig
++oBoZlYDO36TqJa+kvayE+J9Q4MQTHAI1GuQfYsXHxloOpMJE3kse5R9xl+j8DEz
+hwo0HskBPs/CW0UyCLGyDKoiiWXSBQrQOoLr6IqGF1+TKpW/zCJbNoiaZ3C/bDp0
+Rha6wBuE25STLtTrtXxY4bij8Svflun+XzbBIv6B3HFjGIJtQOwiU8HSD88h0Iyb
+7CWSwjFQ04zTrVR0aggzAxpz1HvOmzjfpUhJ5rjWmr18nJ5Ub8wRytqv2SApVZaP
+J1tegrrXXsF/2q3p+WHuowE/5rZWx0Iu1TmC1GnL743i7jzLt/M4HAYhgIlJGA0L
+uHqrxetDuRNE1SB2d6EBL3/aSiFffP1yusMWNt7cZkoXqVKshhcb68ubfUBUrIIN
+FknMCqMhPTSYRN9XV/TTabN+KIw5qC6nwZfsBETlAXv1mHo7I0CBm7S5lLQfjAIg
+4p6JgcwVyePAUeHFAplDmHVqDRZaG9HSnLtabncetlrkAb/7D4QWgbjitN+fZr8R
+I3vKskkmkeAASc4AXFx60yV9weH3VytEgR/uVP8gN4y3WrD33IKQy7MJIi+AJ/g8
+0wF0eKgBoo0lgiHUpV+3E9MRhKAggH5nNFHz2Y9IM3N2B1l0W0pv0vvLcaf+RzPC
+qmt644jTAm+e9DUr7eEzYiMzLO7uaYMpuaISQP+FWrXxEasx33aGbCwc0a40BOVQ
+RHnw91Oyc5LoOs5LOlGEPOX2facM/5se+Xv0d4bopH8lxWSYnpRUq7TOZkBRVmkO
+CAe6CfChLTRGUggWxxZ7mCYRd9cUrrJegdHCgFX0vOEaldVw80lCeKhSVfMp4I3S
+uNUgMCitwkMczgW7GgQaN9vcMPhdXFolnuVIGOJsdZ8IZ/UPrqMjBqNULoOZlHqG
+q7/yCni95yKWl2RBOVJ+iclxZdvf457reS9CZK/cGJvcmphebcKxWsCqqjoeOfB0
+JG+EId16llTscBnUQQCrXTApfZY4DPZkB7f5vhPCFuBG1w5lDB4QcDs68yRSWMCP
+p4KkgBjda3Q2sc9j40qJLHWeHdWvii0mEHnFoUzV1N0nmljmGq4DW/L4JPBc2XfY
+/S1Ii92Hj4JaPZm4OZRE7qLfctdF5JuwUcpRHnrUMxEhfM1tBfT4LXd2qVcwl/W8
+4Wqdc4NaMv5jFjFCL0Wq/27umUek3YMZvlJcV+csXpXDC2cQbLOVa3dm9HLuXA+S
+TyzxlheTlkV7BEO+ZYsf3+rNuc4r04iE7v5Yh8Zx7JHy6HftZmkddOeCPLhi2Fmk
+dINAxldxeIbE2izFcXQgzgWXU4LXRft/5sBNVOUzAmMKDiGhPRtjyPD9OGvXgokO
+2CU+QjfeIqaw0AflVSt2NoQcgesqc3LrEtTRO6C1S3wMCS4LRjwmVIKTT7v8dZ8m
+31IsVgnZNNIrTLOI5WUj9v7nJ24DSs6D6agW/EfdvckdHj0gUv5CDRUck8fYr1Ll
+UB9UD+CbXYkQSiZaOz4ovoIyrjaiLdMZE9XD/Z/Uk5JO2nJ6hNVFdyoZmhVLUwf7
+PPixUkaciCrf4/J/ON6eAKPf6/u+57E/jUN2wOwqoKPtpaXw9lwXkcaEob3Ecr1m
+dJmGFAIuU7Z9OTqgnhF/YBS7e7L162lXBQF20Klk5L2QlKDsRXSiiE1ibJBwM/yF
+MePSpCDKxBbw6KXqnQDkND/APSi2htbbRl8fxpfswQqLJcpvSf1aNa38dP6xxXuA
+UpXNl9/zOs0iK/A94QbF/ao/2ZmqY5KVjdOa0Z9KEtaeSRUczU7gFfr2zzY+Ko41
+/VJEKBZa8rQR9po8zhuT3+fxaKdN4EHAuWZCHxRZdD9THuZzaO3fic7t+/2eg/UU
+dJ3VRGRxpopFU+UHtL96Vh54qckantz9Hfp1kwUnjDbR/t+mE1TAgUvvjvOzZ68U
+gaE8shVb7NNasnKQWvoA844JwrdF1ZF24nFIo5lRl6ACgX5K2O/WUyI8Jx3SRIm5
++gNebOE8KncaWb8E+Nk4y+YMXJpWkbZ1VJNSl1o7mD9GQVQSnRiIyoPz/E0Si/2h
+Pa7N/7h2wJ0Vz67cEYLYHkIeCPaXOcHJVUSsb0WLOpS5oaP3ilHEpvKF96ZF3Ce9
+O2xOXEkVQRF8TNjXGhr7el7Fn79rjQZUlNZKQmj1Aufp3dr0yeeWoObxjbo/mB1V
+PyKimQumf/RZoTBNJqM6fdiHJlobQJ6FgjoacuGoV2Q5Tdfb7CXF0rjfd15YZR5M
+EumOha8fQETdcyZ0U29MWXC9z/WmkG/Fh0LqFyCSe84P7lhZ1noHDBb6MYfCkd19
+o32julo2Rl9utdz3EVKmUDxY3Tw7fFzQHVlg5vZWv8FeXPm/jnhmnSVftDOcRLCL
+eTQP/AEl1EuTtL7Nhjabk/3MEjTgi7I1zMHYv42Vg74fn6IPtUWGHWC77hTevoyI
+TZnS2cQXt11ILdYDXmR8lpBRlcGU3bLB1XxTPMHmFE2IkgxIuwjvPpiqF+nqaayV
+g2ZZgb6/djNnOMSspy4V6bNhJ1fSRamxIYIi9y395/93fmTBJt07+Bix4PlKtCGA
+NYfnFAhPg8YW2AFaw+H+tdnXuCfdwjtDc1G8+WWYS+SoHyOsCLNUa6wkd7Qsp5Cv
+KIwT7Vkw/hQFzqf72Y3/i4BY/EXjEGKfruaZozpDkepovVzKTgh86JKrioFbG+Q1
+7CP6KIYBC3G0qwQXjZAzVNUcDp2GchcCvr7xSNWCeOgzZbHSFDmzxZ03Fo30Txpu
+8ZnaRcEuLpZ60FKgkiO4rXOyVqbSXpcIDlsocNz12Qx4tv41ZHfHbJ4Iv2mGSGpQ
+jKttRdfzaXJpYSd9sPAb2phr
+-----END PRIVATE KEY-----
diff --git a/certs/renewcerts.sh b/certs/renewcerts.sh
index 1a96869565..9034907a6a 100755
--- a/certs/renewcerts.sh
+++ b/certs/renewcerts.sh
@@ -1287,6 +1287,45 @@ EOF
 
         rm -f mldsa/ecc-leaf-mldsa44.csr mldsa/ecc-leaf.ext mldsa/mldsa44-cert.srl
         echo "End of ecc-leaf-mldsa44 section"
+
+        # Cross-level chain (ML-DSA-65 leaf signed by an ML-DSA-87 CA); tests
+        # that verification uses the verifying key's own ML-DSA level, not
+        # the leaf's.
+        echo "Generating mldsa87-ca / mldsa65-leaf87ca cross-level chain..."
+
+        "$OPENSSL3" genpkey -algorithm ML-DSA-87 -out mldsa/mldsa87-ca-key.pem
+        check_result $? "mldsa87-ca key generation"
+
+        "$OPENSSL3" req -x509 -new -key mldsa/mldsa87-ca-key.pem -days 3650 \
+            -subj "/C=US/ST=Montana/L=Bozeman/O=wolfSSL/CN=ML-DSA-87 CA" \
+            -out mldsa/mldsa87-ca-cert.pem
+        check_result $? "mldsa87-ca certificate generation"
+
+        "$OPENSSL3" genpkey -algorithm ML-DSA-65 \
+            -out mldsa/mldsa65-leaf87ca-key.pem
+        check_result $? "mldsa65-leaf87ca key generation"
+
+        "$OPENSSL3" req -new -key mldsa/mldsa65-leaf87ca-key.pem \
+            -subj "/C=US/ST=Montana/L=Bozeman/O=wolfSSL/CN=ML-DSA-65 leaf signed by ML-DSA-87" \
+            -out mldsa/leaf87ca.csr
+        check_result $? "mldsa65-leaf87ca request"
+
+        "$OPENSSL3" x509 -req -in mldsa/leaf87ca.csr \
+            -CA mldsa/mldsa87-ca-cert.pem -CAkey mldsa/mldsa87-ca-key.pem \
+            -CAcreateserial -days 3650 \
+            -out mldsa/mldsa65-leaf87ca-cert.pem
+        check_result $? "mldsa65-leaf87ca certificate generation"
+
+        "$OPENSSL3" x509 -in mldsa/mldsa87-ca-cert.pem -outform DER \
+            -out mldsa/mldsa87-ca-cert.der
+        check_result $? "mldsa87-ca DER conversion"
+
+        "$OPENSSL3" x509 -in mldsa/mldsa65-leaf87ca-cert.pem -outform DER \
+            -out mldsa/mldsa65-leaf87ca-cert.der
+        check_result $? "mldsa65-leaf87ca DER conversion"
+
+        rm -f mldsa/leaf87ca.csr mldsa/mldsa87-ca-cert.srl
+        echo "End of cross-level chain section"
         echo "---------------------------------------------------------------------"
     else
         echo "Skipping ML-DSA cert generation (no OpenSSL 3.5+ built-in ML-DSA provider found)"
diff --git a/src/ssl.c b/src/ssl.c
index f5a309552c..9db76d18a1 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -6911,7 +6911,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
 #ifdef WOLFSSL_HAVE_ERROR_QUEUE
         return (unsigned long)wc_GetErrorNodeErr();
 #else
-        return (unsigned long)(0 - NOT_COMPILED_IN);
+        return 0;
 #endif
     }
 #endif
@@ -12400,7 +12400,7 @@ unsigned long wolfSSL_ERR_peek_last_error_line(const char **file, int *line)
         return (unsigned long)ret;
     }
 #else
-    return (unsigned long)(0 - NOT_COMPILED_IN);
+    return 0;
 #endif
 }
 
@@ -13374,7 +13374,7 @@ unsigned long wolfSSL_ERR_peek_last_error(void)
         return (unsigned long)ret;
     }
 #else
-    return (unsigned long)(0 - NOT_COMPILED_IN);
+    return 0;
 #endif
 }
 
diff --git a/src/x509.c b/src/x509.c
index 2df1f793dc..3842b2feb6 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -6430,8 +6430,15 @@ WOLFSSL_EVP_PKEY* wolfSSL_X509_get_pubkey(WOLFSSL_X509* x509)
         #ifdef WOLFSSL_HAVE_MLDSA
             else if (x509->pubKeyOID == ML_DSA_44k ||
                      x509->pubKeyOID == ML_DSA_65k ||
-                     x509->pubKeyOID == ML_DSA_87k) {
+                     x509->pubKeyOID == ML_DSA_87k
+        #ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
+                     || x509->pubKeyOID == DILITHIUM_LEVEL2k ||
+                     x509->pubKeyOID == DILITHIUM_LEVEL3k ||
+                     x509->pubKeyOID == DILITHIUM_LEVEL5k
+        #endif
+                     ) {
                 key->type = WC_EVP_PKEY_DILITHIUM;
+                WOLFSSL_ATOMIC_STORE(key->mldsaOID, x509->pubKeyOID);
             }
         #endif
             else {
@@ -8988,6 +8995,16 @@ static int verifyX509orX509REQ(WOLFSSL_X509* x509, WOLFSSL_EVP_PKEY* pkey,
             type = DSAk;
             break;
 
+    #if defined(WOLFSSL_HAVE_MLDSA)
+        case WC_EVP_PKEY_DILITHIUM:
+            type = WOLFSSL_ATOMIC_LOAD(pkey->mldsaOID);
+            if (type == 0) {
+                WOLFSSL_MSG("ML-DSA pkey missing key OID");
+                return WOLFSSL_FATAL_ERROR;
+            }
+            break;
+    #endif
+
         default:
             WOLFSSL_MSG("Unknown pkey key type");
             return WOLFSSL_FATAL_ERROR;
diff --git a/tests/api/test_mldsa.c b/tests/api/test_mldsa.c
index f86a513cfa..eff7746520 100644
--- a/tests/api/test_mldsa.c
+++ b/tests/api/test_mldsa.c
@@ -3056,13 +3056,8 @@ int test_mldsa_der(void)
     /* When security level is not set, we attempt to parse it from DER. Since
      * the supplied DER is invalid, this should fail with ASN parsing error */
     idx = 0;
-#ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
-    ExpectIntEQ(wc_MlDsaKey_PublicKeyDecode(key, der, pubDerLen, &idx),
-                WC_NO_ERR_TRACE(BAD_FUNC_ARG));
-#else
     ExpectIntEQ(wc_MlDsaKey_PublicKeyDecode(key, der, pubDerLen, &idx),
                 WC_NO_ERR_TRACE(ASN_PARSE_E));
-#endif
     idx = 0;
 #ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
     ExpectIntEQ(wc_MlDsaKey_PrivateKeyDecode(key, der, privDerLen, &idx),
diff --git a/tests/api/test_ossl_x509_crypto.c b/tests/api/test_ossl_x509_crypto.c
index 2199e3e4ec..ddc5b83f13 100644
--- a/tests/api/test_ossl_x509_crypto.c
+++ b/tests/api/test_ossl_x509_crypto.c
@@ -82,6 +82,7 @@ int test_wolfSSL_X509_check_private_key_mldsa(void)
     !defined(NO_BIO) && !defined(NO_CHECK_PRIVATE_KEY) && \
     defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_SIGN) && \
     !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
+    !defined(WOLFSSL_MLDSA_NO_ASN1) && \
     (defined(OPENSSL_ALL) || defined(WOLFSSL_WPAS_SMALL)) && \
     (!defined(WOLFSSL_NO_ML_DSA_44) || !defined(WOLFSSL_NO_ML_DSA_65) || \
      !defined(WOLFSSL_NO_ML_DSA_87))
@@ -253,6 +254,109 @@ int test_wolfSSL_X509_verify(void)
     return EXPECT_RESULT();
 }
 
+/* Verify must use the verifying key's own ML-DSA level, not the leaf's. */
+int test_wolfSSL_X509_verify_mldsa_cross_level(void)
+{
+    EXPECT_DECLS;
+#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && \
+    defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
+    !defined(WOLFSSL_MLDSA_NO_ASN1) && \
+    !defined(WOLFSSL_NO_ML_DSA_44) && !defined(WOLFSSL_NO_ML_DSA_65) && \
+    !defined(WOLFSSL_NO_ML_DSA_87)
+    WOLFSSL_X509* ca = NULL;
+    WOLFSSL_X509* leaf = NULL;
+    WOLFSSL_X509* wrongLevelCert = NULL;
+    WOLFSSL_EVP_PKEY* caPubKey = NULL;
+    WOLFSSL_EVP_PKEY* d2iPubKey = NULL;
+    WOLFSSL_EVP_PKEY* wrongLevelPubKey = NULL;
+    unsigned char buf[4096];
+    const unsigned char* pt = NULL;
+    int bufSz;
+
+    ExpectNotNull(ca = wolfSSL_X509_load_certificate_file(
+        "./certs/mldsa/mldsa87-ca-cert.der", WOLFSSL_FILETYPE_ASN1));
+    ExpectNotNull(leaf = wolfSSL_X509_load_certificate_file(
+        "./certs/mldsa/mldsa65-leaf87ca-cert.der", WOLFSSL_FILETYPE_ASN1));
+
+    ExpectNotNull(caPubKey = wolfSSL_X509_get_pubkey(ca));
+    ExpectIntEQ(wolfSSL_X509_verify(leaf, caPubKey), WOLFSSL_SUCCESS);
+
+    /* Same key via d2i_PUBKEY (raw SPKI, no cert). */
+    bufSz = (int)sizeof(buf);
+    ExpectIntEQ(wolfSSL_X509_get_pubkey_buffer(ca, buf, &bufSz),
+        WOLFSSL_SUCCESS);
+    pt = buf;
+    ExpectNotNull(d2iPubKey = wolfSSL_d2i_PUBKEY(NULL, &pt, bufSz));
+    ExpectIntEQ(wolfSSL_X509_verify(leaf, d2iPubKey), WOLFSSL_SUCCESS);
+
+    /* Wrong-level key must fail. */
+    ExpectNotNull(wrongLevelCert = wolfSSL_X509_load_certificate_file(
+        "./certs/mldsa/mldsa44-cert.der", WOLFSSL_FILETYPE_ASN1));
+    ExpectNotNull(wrongLevelPubKey = wolfSSL_X509_get_pubkey(wrongLevelCert));
+    ExpectIntEQ(wolfSSL_X509_verify(leaf, wrongLevelPubKey),
+        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
+
+    wolfSSL_EVP_PKEY_free(caPubKey);
+    wolfSSL_EVP_PKEY_free(d2iPubKey);
+    wolfSSL_EVP_PKEY_free(wrongLevelPubKey);
+    wolfSSL_FreeX509(ca);
+    wolfSSL_FreeX509(leaf);
+    wolfSSL_FreeX509(wrongLevelCert);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* EVP_PKCS82PKEY() decodes the DER itself (via d2iTryMlDsaKey()), which
+ * already knows the OID from that decode and stashes it on the pkey, so
+ * wolfSSL_X509_verify() has what it needs even though this pkey was never
+ * loaded from a cert. */
+int test_wolfSSL_X509_verify_mldsa_privkey_pkey(void)
+{
+    EXPECT_DECLS;
+#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_BIO) && \
+    defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_SIGN) && \
+    !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
+    defined(WOLFSSL_MLDSA_PRIVATE_KEY) && !defined(WOLFSSL_MLDSA_NO_ASN1) && \
+    (defined(OPENSSL_ALL) || defined(WOLFSSL_WPAS_SMALL)) && \
+    !defined(WOLFSSL_NO_ML_DSA_44)
+    PKCS8_PRIV_KEY_INFO* pt = NULL;
+    EVP_PKEY* pkey = NULL;
+    X509* x509 = NULL;
+    BIO* bio = NULL;
+    byte* buf = NULL;
+    size_t sz = 0;
+
+    ExpectIntEQ(load_file("./certs/mldsa/mldsa44-key.pem", &buf, &sz), 0);
+    ExpectNotNull(bio = BIO_new_mem_buf((void*)buf, (int)sz));
+    ExpectNotNull(pt = d2i_PKCS8_PRIV_KEY_INFO_bio(bio, NULL));
+    ExpectNotNull(pkey = EVP_PKCS82PKEY(pt));
+    if (pkey != NULL) {
+        /* Not loaded from a cert, but d2iTryMlDsaKey() already decoded the
+         * DER once to build this pkey, so it stashes the OID it already
+         * knows instead of leaving it to be rediscovered later. */
+        ExpectIntEQ(WOLFSSL_ATOMIC_LOAD(pkey->mldsaOID), ML_DSA_44k);
+        ExpectNotNull(pkey->pkey.ptr);
+        ExpectIntGT(pkey->pkey_sz, 0);
+    }
+
+    ExpectNotNull(x509 = X509_load_certificate_file(
+        "./certs/mldsa/mldsa44-cert.der", SSL_FILETYPE_ASN1));
+
+    /* Fails the actual signature check (this is a private key, not the
+     * cert's public key), but must not hit the "missing key OID"
+     * FATAL_ERROR path. */
+    ExpectIntEQ(wolfSSL_X509_verify(x509, pkey),
+        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
+
+    X509_free(x509);
+    EVP_PKEY_free(pkey);
+    PKCS8_PRIV_KEY_INFO_free(pt);
+    BIO_free(bio);
+    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
 int test_wolfSSL_X509_sign(void)
 {
     EXPECT_DECLS;
diff --git a/tests/api/test_ossl_x509_crypto.h b/tests/api/test_ossl_x509_crypto.h
index cf40bca9a3..68ce053d6b 100644
--- a/tests/api/test_ossl_x509_crypto.h
+++ b/tests/api/test_ossl_x509_crypto.h
@@ -27,6 +27,8 @@
 int test_wolfSSL_X509_check_private_key(void);
 int test_wolfSSL_X509_check_private_key_mldsa(void);
 int test_wolfSSL_X509_verify(void);
+int test_wolfSSL_X509_verify_mldsa_cross_level(void);
+int test_wolfSSL_X509_verify_mldsa_privkey_pkey(void);
 int test_wolfSSL_X509_sign(void);
 int test_wolfSSL_X509_sign2(void);
 int test_wolfSSL_make_cert(void);
@@ -36,6 +38,10 @@ int test_wolfSSL_make_cert(void);
     TEST_DECL_GROUP("ossl_x509_crypto",                                        \
         test_wolfSSL_X509_check_private_key_mldsa),                            \
     TEST_DECL_GROUP("ossl_x509_crypto", test_wolfSSL_X509_verify),             \
+    TEST_DECL_GROUP("ossl_x509_crypto",                                        \
+        test_wolfSSL_X509_verify_mldsa_cross_level),                           \
+    TEST_DECL_GROUP("ossl_x509_crypto",                                        \
+        test_wolfSSL_X509_verify_mldsa_privkey_pkey),                          \
     TEST_DECL_GROUP("ossl_x509_crypto", test_wolfSSL_X509_sign),               \
     TEST_DECL_GROUP("ossl_x509_crypto", test_wolfSSL_X509_sign2),              \
     TEST_DECL_GROUP("ossl_x509_crypto", test_wolfSSL_make_cert)
diff --git a/wolfcrypt/src/evp_pk.c b/wolfcrypt/src/evp_pk.c
index e4ae5f918b..73b9ddc3f6 100644
--- a/wolfcrypt/src/evp_pk.c
+++ b/wolfcrypt/src/evp_pk.c
@@ -1001,6 +1001,8 @@ static int d2iTryMlDsaKey(WOLFSSL_EVP_PKEY** out, const unsigned char* mem,
     word32 keyIdx = 0;
     int isMlDsa = 0;
     int i, numLevels, rc;
+    int oidSum = 0;
+    int ret;
     WC_DECLARE_VAR(mldsa, wc_MlDsaKey, 1, NULL);
 
 #if !defined(WOLFSSL_MLDSA_PRIVATE_KEY)
@@ -1064,6 +1066,16 @@ static int d2iTryMlDsaKey(WOLFSSL_EVP_PKEY** out, const unsigned char* mem,
         }
     }
 
+    if (isMlDsa) {
+        /* Level is already known from the successful import/decode above -
+         * grab the OID now so callers don't need to re-decode the key
+         * later just to recover it (e.g. wolfSSL_X509_verify()). */
+        int keyFormat = 0;
+        if (mldsa_get_oid_sum(mldsa, &keyFormat) == 0) {
+            oidSum = keyFormat;
+        }
+    }
+
     wc_MlDsaKey_Free(mldsa);
     WC_FREE_VAR_EX(mldsa, NULL, DYNAMIC_TYPE_MLDSA);
 
@@ -1072,7 +1084,11 @@ static int d2iTryMlDsaKey(WOLFSSL_EVP_PKEY** out, const unsigned char* mem,
     }
 
     /* Copy the consumed DER into pkey->pkey.ptr when the input was DER */
-    return d2i_make_pkey(out, mem, keyIdx, priv, WC_EVP_PKEY_DILITHIUM);
+    ret = d2i_make_pkey(out, mem, keyIdx, priv, WC_EVP_PKEY_DILITHIUM);
+    if ((ret == 1) && (out != NULL) && (*out != NULL) && (oidSum != 0)) {
+        WOLFSSL_ATOMIC_STORE((*out)->mldsaOID, oidSum);
+    }
+    return ret;
 }
 #endif /* WOLFSSL_HAVE_MLDSA */
 
diff --git a/wolfcrypt/src/logging.c b/wolfcrypt/src/logging.c
index a6d2786820..436d3df266 100644
--- a/wolfcrypt/src/logging.c
+++ b/wolfcrypt/src/logging.c
@@ -1680,6 +1680,8 @@ int wc_ERR_remove_state(void)
     return 0;
 }
 
+/* Returns 0 both when the error queue is empty and when
+ * WOLFSSL_HAVE_ERROR_QUEUE is not compiled in. */
 unsigned long wc_PeekErrorNodeLineData(const char **file, int *line,
                                        const char **data, int *flags,
                                        int (*ignore_err)(int err))
@@ -1695,13 +1697,15 @@ unsigned long wc_PeekErrorNodeLineData(const char **file, int *line,
     if (flags != NULL) {
         *flags = 0;
     }
-    return (unsigned long)(0 - NOT_COMPILED_IN);
+    return 0;
 }
 
+/* Returns 0 both when the error queue is empty and when
+ * WOLFSSL_HAVE_ERROR_QUEUE is not compiled in. */
 int wc_GetErrorNodeErr(void)
 {
     WOLFSSL_ENTER("wc_GetErrorNodeErr");
-    return (0 - NOT_COMPILED_IN);
+    return 0;
 }
 
 #if !defined(NO_FILESYSTEM) && !defined(NO_STDIO_FILESYSTEM)
diff --git a/wolfcrypt/src/wc_mldsa.c b/wolfcrypt/src/wc_mldsa.c
index b564167111..addac864f2 100644
--- a/wolfcrypt/src/wc_mldsa.c
+++ b/wolfcrypt/src/wc_mldsa.c
@@ -12066,32 +12066,8 @@ int wc_MlDsaKey_ExportKey(wc_MlDsaKey* key, byte* priv, word32 *privSz,
 
 #endif /* WOLFSSL_MLDSA_PRIVATE_KEY */
 
-#ifndef WOLFSSL_MLDSA_NO_ASN1
-
-/* Maps ASN.1 OID to wolfCrypt security level macros */
-static int mapOidToSecLevel(int oid)
-{
-    switch (oid) {
-        case ML_DSA_44k:
-            return WC_ML_DSA_44;
-        case ML_DSA_65k:
-            return WC_ML_DSA_65;
-        case ML_DSA_87k:
-            return WC_ML_DSA_87;
-#ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
-        case DILITHIUM_LEVEL2k:
-            return WC_ML_DSA_44_DRAFT;
-        case DILITHIUM_LEVEL3k:
-            return WC_ML_DSA_65_DRAFT;
-        case DILITHIUM_LEVEL5k:
-            return WC_ML_DSA_87_DRAFT;
-#endif
-        default:
-            return ASN_UNKNOWN_OID_E;
-    }
-}
-
-/* Get OID sum from ML-DSA key */
+/* Get OID sum from ML-DSA key. No ASN.1 dependency, so available regardless
+ * of WOLFSSL_MLDSA_NO_ASN1. */
 int mldsa_get_oid_sum(wc_MlDsaKey* key, int* keyFormat) {
     int ret = 0;
 
@@ -12127,6 +12103,31 @@ int mldsa_get_oid_sum(wc_MlDsaKey* key, int* keyFormat) {
     return ret;
 }
 
+#ifndef WOLFSSL_MLDSA_NO_ASN1
+
+/* Maps ASN.1 OID to wolfCrypt security level macros */
+static int mapOidToSecLevel(int oid)
+{
+    switch (oid) {
+        case ML_DSA_44k:
+            return WC_ML_DSA_44;
+        case ML_DSA_65k:
+            return WC_ML_DSA_65;
+        case ML_DSA_87k:
+            return WC_ML_DSA_87;
+#ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
+        case DILITHIUM_LEVEL2k:
+            return WC_ML_DSA_44_DRAFT;
+        case DILITHIUM_LEVEL3k:
+            return WC_ML_DSA_65_DRAFT;
+        case DILITHIUM_LEVEL5k:
+            return WC_ML_DSA_87_DRAFT;
+#endif
+        default:
+            return ASN_UNKNOWN_OID_E;
+    }
+}
+
 #if defined(WOLFSSL_MLDSA_PRIVATE_KEY)
 
 /* Decode the DER encoded ML-DSA key.
@@ -12514,13 +12515,10 @@ static int mldsa_oid_to_level(const byte* oid, word32 oidLen, byte* level)
  *                            input, the level will be detected from the DER
  *                            file based on the algorithm OID, appropriately
  *                            decoded, then updated in the key structure on
- *                            output. Auto-detection is not supported for
- *                            FIPS 204 draft mode unless WOLFSSL_MLDSA_NO_ASN1
- *                            is also defined.
+ *                            output.
  * @param [in]      inSz      Total size of data in array.
  * @return  0 on success.
  * @return  BAD_FUNC_ARG when input, inOutIdx or key is NULL or inSz is 0.
- * @return  BAD_FUNC_ARG when level not set and auto-detection unsupported.
  * @return  Other negative on parse error.
  */
 int wc_MlDsaKey_PublicKeyDecode(wc_MlDsaKey* key, const byte* input,
@@ -12554,8 +12552,13 @@ int wc_MlDsaKey_PublicKeyDecode(wc_MlDsaKey* key, const byte* input,
 
     #if !defined(WOLFSSL_MLDSA_NO_ASN1)
             /* Get OID sum for level. */
+            if (key->level == 0) { /* Check first, because key->params will
+                                   * be NULL when key->level = 0 */
+                /* Level not set by caller, decode from DER */
+                keyType = ANONk; /* 0, not a valid key type in this situation*/
+            }
         #if defined(WOLFSSL_MLDSA_FIPS204_DRAFT)
-            if (key->params == NULL) {
+            else if (key->params == NULL) {
                 ret = BAD_FUNC_ARG;
             }
             else if (key->params->level == WC_ML_DSA_44_DRAFT) {
@@ -12567,9 +12570,8 @@ int wc_MlDsaKey_PublicKeyDecode(wc_MlDsaKey* key, const byte* input,
             else if (key->params->level == WC_ML_DSA_87_DRAFT) {
                 keyType = DILITHIUM_LEVEL5k;
             }
-            else
         #endif
-            if (key->level == WC_ML_DSA_44) {
+            else if (key->level == WC_ML_DSA_44) {
                 keyType = ML_DSA_44k;
             }
             else if (key->level == WC_ML_DSA_65) {
@@ -12579,8 +12581,7 @@ int wc_MlDsaKey_PublicKeyDecode(wc_MlDsaKey* key, const byte* input,
                 keyType = ML_DSA_87k;
             }
             else {
-                /* Level not set by caller, decode from DER */
-                keyType = ANONk; /* 0, not a valid key type in this situation*/
+                ret = BAD_FUNC_ARG;
             }
             if (ret == 0) {
                 /* Decode the asymmetric key and get out public key data. */
diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index 0022a5181e..4c419e6ea3 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -633,6 +633,9 @@ struct WOLFSSL_EVP_PKEY {
 #endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
 #ifdef HAVE_ECC
     int pkey_curve;
+#endif
+#ifdef WOLFSSL_HAVE_MLDSA
+    wolfSSL_Atomic_Int mldsaOID;
 #endif
     word16 pkcs8HeaderSz;
 
diff --git a/wolfssl/wolfcrypt/wc_mldsa.h b/wolfssl/wolfcrypt/wc_mldsa.h
index 12384878e4..775f12f375 100644
--- a/wolfssl/wolfcrypt/wc_mldsa.h
+++ b/wolfssl/wolfcrypt/wc_mldsa.h
@@ -830,9 +830,7 @@ int wc_MlDsaKey_ExportKey(wc_MlDsaKey* key, byte* priv, word32 *privSz,
     byte* pub, word32 *pubSz);
 #endif
 
-#ifndef WOLFSSL_MLDSA_NO_ASN1
 WOLFSSL_LOCAL int mldsa_get_oid_sum(wc_MlDsaKey* key, int* keyFormat);
-#endif /* WOLFSSL_MLDSA_NO_ASN1 */
 
 #ifndef WOLFSSL_MLDSA_NO_ASN1
 #if defined(WOLFSSL_MLDSA_PRIVATE_KEY)