Google has announced a new program in Chrome to develop HTTPS certificates capable of resisting threats that quantum computers may pose, without burdening TLS connections with the bandwidth and performance costs associated with traditional certificates that use post-quantum algorithms. In cooperation with other partners, the company is developing this approach through Merkle Tree Certificates, commonly abbreviated as MTCs, in parallel with the work of the IETF’s PLANTS group.
The initiative comes at a time when the TLS ecosystem faces a practical challenge: quantum-resistant cryptographic algorithms produce larger data, which may increase the size of the X.509 certificate chains required during connection establishment, particularly when Certificate Transparency (CT) requirements are applied.
How Do Merkle Tree Certificates Work?
Rather than relying on a large, sequential chain of signatures in the traditional public key infrastructure, MTCs use compact Merkle Tree proofs. In this model, a certificate authority (CA) signs a single tree root that probabilistically represents millions of certificates, while the browser sends only a lightweight proof showing that the site’s certificate is included in that tree.
Google believes this design could enable the use of strong post-quantum algorithms without the significant bandwidth penalty that traditional X.509 certificate chains may create. The design also separates cryptographic algorithm strength from the amount of data transmitted to the user, with the goal of reducing authentication data in the TLS process to a minimum.
Under this model, transparency assumes a fundamental role in the issuance process: no certificate can be issued without being included in a public tree. This makes the security properties associated with the current Certificate Transparency ecosystem part of the design, without adding the same burden to the TLS process.
Chrome’s Phased Deployment Plan
Chrome has already begun testing MTCs with live internet traffic, and Google says the rollout will proceed in three stages:
- Phase one, ongoing: Google, in cooperation with Cloudflare, is conducting a feasibility study to measure the performance and security of TLS connections that use MTCs. During the test, every MTC connection is supported by a traditional, trusted X.509 certificate, providing a fallback path that allows performance to be measured and issuance reliability to be verified without jeopardizing connection security or stability.
- Phase two, first quarter of 2027: Google intends to invite CT log operators that had at least one usable log in Chrome before February 1, 2026, to participate in the initial launch of public MTC trees.
- Phase three, third quarter of 2027: Google will establish requirements for adding additional certificate authorities to Chrome’s Quantum-Resistant Root Store, known as CQRS, and to the corresponding root program that supports only MTCs. This program will operate alongside the current Chrome Root Program to manage the transition gradually.
A Parallel Trust Architecture and Proposed Changes
Google says the third phase will also allow sites to choose to reduce some protections, enabling sites that want to use only quantum-resistant certificates to follow that option. The company will also continue participating in the IETF and C2SP to ensure that lessons learned from the trials inform standards-development work and to support any relevant standards changes in Chrome.
Google proposes a set of directions for the future TLS architecture, including simplifying the elements required to establish a secure connection, adopting ACME-only workflows, and updating the mechanism for reporting certificate revocation status instead of relying on outdated CRLs, with a focus on key-compromise cases. It is also exploring reproducible verification of domain control, so that control evidence becomes publicly and permanently available for independent verification.
Other directions include prioritizing operational excellence when accepting MTC authorities and developing continuous, verifiable external oversight instead of relying solely on the annual audit function. At the same time, Google will continue supporting its existing partners in the Chrome Root Store and rotating roots to maintain compatibility for non-quantum-resistant chains with the program’s policies. The company expects to support traditional X.509 certificates that use quantum-resistant algorithms within private infrastructures only, and that are not included in the Chrome Root Store, later in 2026.