Preparation for post-quantum cryptography is not limited to protecting encrypted data from the risk of being collected today and decrypted in the future; certificate-based authentication systems will also require extensive changes. These changes include certificate authorities, trust anchors, public key infrastructure services, applications, devices, and hardware security modules.
Microsoft believes the challenge is not only issuing or validating a certificate with a new algorithm, but also understanding how existing certificate chains, platforms, and operational procedures will interact with post-quantum authentication requirements. Early testing may reveal interoperability, certificate size, performance, and lifecycle management issues before remediation at production scale becomes necessary.
From Protecting Confidentiality to Trust Ecosystem Readiness
Discussions about post-quantum cryptography readiness have focused largely on communications confidentiality, particularly the “harvest now, decrypt later” threat. Authentication, however, requires managing a broader network of trust relationships; keys and certificates must be issued, distributed, stored, validated, renewed, and managed across diverse environments and vendors.
Organizations also typically contain infrastructure that has accumulated over decades, including embedded devices, operational systems, security devices, custom applications, external services, and hardware-backed trust systems. Some of these components may have long upgrade cycles or fixed cryptographic assumptions whose limitations become apparent only when testing begins.
Microsoft’s Pilot Program
On August 27, 2026, Microsoft launched the PQC TLS Pilot Program to help eligible certificate authorities evaluate post-quantum TLS roots and certificates. The program is limited to certificate authorities accepted into and compliant with the Microsoft Trusted Root Program, and uses the quantum-resistant signature algorithm ML-DSA-87.
The August 2026 release added seven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com. Acceptance will continue in batches through the end of 2026.
Certificates issued through the program are not publicly trusted and are intended exclusively for interoperability and ecosystem-readiness testing in closed environments, custom applications, and enterprise laboratories. They must not be used for public websites or production trust scenarios. ML-DSA support also remains limited and evolving during the pilot phase, so it should not be relied upon in production.
What Can Organizations Test Now?
ML-DSA certificates can be tested in controlled, non-production scenarios on supported and properly configured Windows 11 systems. Support begins with the July 28, 2026 updates: KB5101681, with operating system build number 28000.2608 for version 26H1, and KB5101684, with build numbers 26200.8973 and 26100.8973 for version 25H2. The certificates can also be used with Secure Channel (Schannel) in supported scenarios, after verifying the platform requirements.
Microsoft recommends that security teams, PKI administrators, and architects begin inventorying certificate-dependent systems, mapping public and private trust relationships, evaluating vendor plans, identifying long-lived infrastructure, and creating non-production testing environments. The results should be turned into a multiyear roadmap that assigns responsibilities and prioritizes update dependencies.
Why Does This News Matter?
The practical change is shifting post-quantum cryptography readiness from an algorithmic discussion to hands-on testing of the entire trust ecosystem. The primary benefit is uncovering size, performance, compatibility, and workflow limits before introducing new certificates into production environments. However, the program does not demonstrate general readiness or production support; it is a limited pilot environment, and successful testing will remain tied to the capabilities of each organization’s existing vendors, devices, and applications.