RSA-2048 remains the most common public key size in TLS certificates. It provides roughly 112 bits of classical security, and it is broken by Shor's algorithm on a sufficiently capable quantum computer.
RSA appears in TLS in two quite different roles, and conflating them leads to badly prioritised remediation.
As a certificate signature: a future risk
Most RSA use today is signing. A certificate is signed with RSA, and clients verify that signature.
Forging a signature requires the quantum computer to exist while the certificate is still valid. There is no retroactive attack: an attacker cannot record a signature today and forge it later, because by then the certificate has expired. With certificates typically rotating every 90 days or less, this resolves largely on its own once post-quantum certificate authorities exist.
As key exchange: a present risk
Static RSA key exchange is the serious case, and it is much worse than it looks.
In a static-RSA handshake the client encrypts the session secret to the server's public key. There is no forward secrecy: anyone holding the server's private key can decrypt every session ever recorded under that key. A quantum computer that recovers the private key from the certificate therefore opens the entire archive at once.
This is why our grading treats a host with no forward secrecy far more harshly than a host with a quantum-vulnerable certificate signature. They are not comparable risks.
Timeline
NIST's draft roadmap deprecates RSA-2048 after 2030 and disallows it after 2035. Deprecation is not prohibition — it means continued use requires documented risk acceptance — but 2035 removes that option.
What to do
Disable static RSA cipher suites. Many servers still accept them when a client offers nothing else, even when they would never be chosen in practice; our scans find this routinely on otherwise well-configured hosts.
For signatures, no action is available yet at scale: post-quantum certificate issuance is not generally available from public CAs. Track it, do not panic about it, and spend the effort on key exchange instead.