Post-quantum authentication: Why organizations should start testing certificate ecosystems now
Microsoft urges organizations to inventory and test certificate systems now for post-quantum authentication using its PQC TLS pilot.
Microsoft says post-quantum planning must cover authentication as well as harvest-now-decrypt-later confidentiality risk, because certificates, PKI services, applications, devices, and hardware security modules will face new algorithms and larger chains. Its PQC TLS Pilot Program, launched August 27, 2026, lets approved certificate authorities in the Microsoft Trusted Root Program test non-public ML-DSA-87 roots and issuance in closed environments. Pilot certificates are not publicly trusted and must not be used for production or public websites. Microsoft recommends inventorying dependencies, reviewing vendor roadmaps, and creating non-production test environments before post-quantum authentication is required at scale.
- PQC TLS Pilot launched August 27, 2026, using ML-DSA-87.
- Pilot certificates are not publicly trusted and are test-only.
- Named authorities include DigiCert, Sectigo, HARICA, IdenTrust, and ComSign.
- Larger chains may affect handshake size, storage, and inspection.
- Microsoft frames readiness as a multi-year inventory and testing effort.
Full article1,382 words · extracted from microsoft.com · click to collapse
Post-quantum cryptography (PQC) planning often focuses on protecting encrypted data, but authentication systems must also evolve. Certificates, trust anchors, PKI services, applications, devices, and hardware security modules may all be affected by new algorithms and larger certificate chains.
Microsoft’s Post-Quantum Cryptography (PQC) Transport Layer Security (TLS) Pilot Program helps eligible certificate authorities evaluate interoperability and operational readiness in controlled environments. Organizations should begin now by inventorying certificate dependencies, assessing vendor roadmaps, identifying long-lived infrastructure, and creating non-production test environments. Early testing can surface compatibility and process gaps before post-quantum authentication is required at scale.
By the end of this article, security leaders, public key infrastructure (PKI) administrators, and architects will understand the key certificate dependencies, migration risks, and practical first steps for post-quantum authentication readiness.
Why post-quantum authentication presents a different challenge
Much of the current PQC readiness discussion focuses on confidentiality and the ‘harvest now, decrypt later’ risk, in which adversaries collect encrypted data today with the expectation that future quantum computers could decrypt it.
Authentication introduces a different set of challenges.
While confidentiality protections primarily focus on safeguarding encrypted communications, authentication depends on a broad ecosystem of technologies and trust relationships. Certificates and private keys must be issued, distributed, stored, validated, renewed, and managed across diverse environments and vendors. Changes to cryptographic algorithms can therefore have implications that extend beyond cryptographic correctness into operational processes, interoperability, and infrastructure readiness.
Organizations frequently understand where TLS protects their communications. Fewer organizations have a complete inventory of every system that issues, validates, stores, distributes, or depends on certificates.
As the industry moves toward post-quantum authentication, security teams will need greater visibility into those dependencies.
Why organizations should begin preparing now
The transition to post-quantum authentication is unlikely to be a single technology upgrade.
Enterprise environments often contain decades of accumulated infrastructure, including internally managed PKI deployments, embedded devices, operational technology, security appliances, custom applications, third-party services, and hardware-backed trust systems. Some of these technologies may have long deployment lifecycles, fixed cryptographic assumptions, or operational constraints that are not immediately visible until testing begins.
The challenge facing organizations is not that post-quantum standards are unavailable. Rather, it is understanding how proposed post-quantum certificate hierarchies interact with the systems and processes already deployed across their environments.
Testing helps answer questions such as:
- Can existing applications correctly process and validate post-quantum certificates?
- How do larger post-quantum certificates and certificate chains affect handshake size, performance, storage, transmission, and inspection limits?
- Do enterprise PKI workflows require changes to accommodate new algorithms?
- Are network monitoring, inspection, or certificate-management systems prepared for post-quantum authentication?
- Are hardware security modules and other cryptographic infrastructure components ready to support future certificate requirements?
- What hidden dependencies exist within supply chains, vendors, and third-party services?
In many cases, organizations may not yet know which of these questions are most relevant to their environments. Identifying those unknowns is one of the primary reasons ecosystem testing is important today.
Microsoft’s perspective on readiness
Post-quantum authentication readiness requires validating how certificate chains, platforms, and operational processes behave together.
The goal is not simply to determine whether a certificate can be issued or validated. The goal is to identify interoperability, compatibility, performance, and operational challenges before post-quantum authentication must be deployed at scale.
Organizations should view post-quantum readiness as a multi-year planning effort rather than a future migration project. Security leaders who begin inventorying dependencies, assessing vendor readiness, and testing interoperability now will be better positioned to make informed decisions as standards, platform support, and industry requirements continue to evolve.
Testing the future certificate ecosystem
To help the ecosystem gain practical experience with post-quantum authentication, Microsoft launched the PQC TLS Pilot Program on August 27, 2026.
The pilot enables approved certificate authorities in good standing with the Microsoft Trusted Root Program to evaluate PQC TLS roots and certificate issuance using quantum-resilient Module-Lattice-Based Digital Signal Algorithm, ML-DSA-87.
The program is intended to create a controlled environment where participants can evaluate interoperability, compatibility, performance, and operational considerations associated with post-quantum certificate hierarchies.
Certificates issued through the pilot are not publicly trusted and are intended solely for interoperability and ecosystem-readiness testing in closed environments, custom applications, and enterprise testbeds. They must not be used for production trust scenarios or public-facing websites. ML-DSA support remains limited and evolving during the pilot and should not be relied upon for production use.
According to the Microsoft Trusted Root Program Annoucement, the August 2026 release added seven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.
The pilot will continue with rolling admissions through the end of 2026, providing additional opportunities for eligible certificate authorities participating in the Microsoft Trusted Root Program to join. Organizations that participate in the Microsoft Trusted Root Program and are interested in evaluating post-quantum authentication readiness should review the PQC TLS Pilot Program requirements and application process through the https://aka.ms/rootcert. The pilot provides eligible certificate authorities with an opportunity to test interoperability, operational processes, and ecosystem readiness ahead of broader post-quantum authentication adoption.
The objective is not to validate a predetermined outcome. It is to help the certificate ecosystem discover where modernization, testing, and operational improvements may be required before post-quantum authentication can be adopted broadly.
Expanding end-to-end testing
On supported and appropriately configured Windows 11 systems, ML-DSA certificates can be evaluated in the pilot’s controlled, non-production testing scenarios. Support begins with the July 28, 2026 updates: KB5101681 (OS Build 28000.2608) for 26H1 and KB5101684 (OS Builds 26200.8973 and 26100.8973) for 25H2.
ML-DSA certificates can also be used with Secure Channel (Schannel) in supported scenarios. Confirm the applicable Windows and Schannel platform requirements before testing.
Together, Microsoft platform support and the PQC TLS Pilot Program provide a controlled way to identify application incompatibilities, certificate-size constraints, performance effects, and operational workflow gaps before they affect production environments.
What organizations can do today
Organizations do not need to wait for broad industry adoption to begin preparing for post-quantum authentication.
Security leaders, PKI administrators, and architects can begin by:
1. Inventory certificate-dependent systems. Identify applications, services, devices, appliances, and infrastructure that depend on certificates for authentication, trust establishment, or lifecycle management.
2. Map trust relationships.
Document both public and private PKI environments, including internal certificate hierarchies, trust anchors, device authentication systems, and externally managed certificates.
3. Assess vendor readiness.
Engage certificate providers, PKI vendors, hardware security module (HSM) providers, software vendors, and platform providers to understand their post-quantum roadmaps and testing capabilities.
4. Identify long-lived infrastructure.
Pay particular attention to systems with lengthy upgrade cycles, including embedded devices, appliances, operational technology environments, and security infrastructure.
5. Develop a safe testing strategy.
Establish non-production environments where post-quantum certificate hierarchies can be evaluated for interoperability, performance, and operational impacts.
6. Build a multi-year transition roadmap.
Treat post-quantum authentication readiness as a program rather than a project. Assign owners, sequence dependencies, and use test results to prioritize modernization work before future requirements emerge.
Organizations interested in testing should consult their certificate provider about whether it participates in the pilot and whether it offers testing opportunities appropriate for their environment.
If your certificate provider participates in the Microsoft Trusted Root Program but is not currently part of the pilot, consider encouraging them to participate through the program’s admissions process.
Looking ahead
Post-quantum authentication will require coordinated changes across certificate authorities, platforms, software, hardware, and enterprise environments. Organizations that begin testing trust infrastructure and certificate dependencies now will be better positioned to reduce future migration risk and strengthen readiness for a quantum-resistant future.
Learn more
- PQC TLS Pilot Program Requirements
- Microsoft Trusted Root Program Announcements
- New Windows Features to Secure Today’s Data in a Post-Quantum World | Microsoft Community Hub
- ASP.NET, Kestrel and Schannel GA with TLS 1.3 Post-Quantum Cryptography
- Quantum-safe security: Progress towards next-generation cryptography
- Microsoft’s quantum-resistant cryptography is here | Microsoft Community Hub
- Post-Quantum Cryptography APIs Now Generally Available on Microsoft Platforms
- For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.
- To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.
- To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.