ECDSA over NIST P-256 (secp256r1) is the most common elliptic-curve signature algorithm in TLS certificates. It offers roughly 128 bits of classical security with much smaller keys and signatures than RSA.
Like all classical public-key cryptography, it is broken by Shor's algorithm.
Why it is graded gently
We report quantum-vulnerable certificate signatures, but we weight them far below key exchange, and the reasoning is worth stating plainly.
A signature attack requires the attacker to have a quantum computer during the certificate's validity window. Certificates are short-lived and getting shorter. There is no way to record a signature now and forge it later.
A key exchange attack does not have that constraint. The traffic is captured today and decrypted whenever the capability arrives. That asymmetry is why our grading methodology puts 60% of the score on key exchange.
The same curve in two roles
P-256 appears both as a signature curve (ECDSA) and as a key-exchange group (ECDH over secp256r1). These are graded differently for the same reason as above: the ECDH use is retroactively attackable, the ECDSA use is not.
A host can perfectly reasonably keep an ECDSA P-256 certificate while moving its key exchange to a hybrid group. That combination is not inconsistent — it is the correct order of operations.
What replaces it
NIST standardised ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. The constraint is not the algorithms but the ecosystem: public certificate authorities do not yet issue post-quantum certificates at scale, and every client that must validate them needs support first.
This is a good argument for crypto-agility — being able to change algorithm without re-architecting — rather than for waiting.