What EO 14412 means for a pipeline operator's certificate inventory

Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks" (signed June 22, 2026), sets federal deadlines for moving to post-quantum cryptography: key establishment by December 31, 2030, and digital signatures by December 31, 2031. The order is addressed to federal agencies and does not mention pipelines, but it reaches private critical infrastructure through Sector Risk Management Agency assistance, a forthcoming FAR rule for federal contractors, and CISA/NIST guidance on a cryptographic bill of materials. This technical note explains what the order means for U.S. natural gas and hazardous liquids pipeline operators and argues that the practical first step is an inventory of X.509 certificates in operational technology (OT) environments. It maps where certificates live in pipeline OT (remote-access gateways, OT Active Directory, historians and HMIs, OPC UA, secured DNP3 and IEC 60870-5-104 links, backhaul equipment, and vendor firmware-signing roots), describes how to collect them without disturbing the process, proposes a triage aligned to the order's two deadlines, and lists five actions for the next 90 days. A companion open-source tool, cert_inventory.py, reads exported certificates into a CSV inventory without connecting to any device. Issue 01 (September 2026 slot) of Quantum-Safe Pipeline Notes, a monthly technical blog on post-quantum cryptography and OT security for U.S. pipelines. Uses public sources only; views are the author's own and do not represent any employer or client.