Microsoft Expands Testing for Post-Quantum Certificate Authentication
Summary
Microsoft’s PQC TLS pilot lets eligible certificate authorities test post-quantum certificates in controlled environments. The company urges organizations to inventory certificate dependencies and assess interoperability, performance, and operational readiness.
Key points
- The pilot allows eligible certificate authorities to test certificate issuance and interoperability using the ML-DSA-87 algorithm.
- Pilot certificates are not publicly trusted and are intended only for closed, non-production testing—not production trust or public-facing websites.
- Seven pilot roots were added in August 2026; rolling admissions are planned through the end of 2026.
- Supported, appropriately configured Windows 11 systems can evaluate ML-DSA certificates in controlled scenarios, including supported Schannel use.
- Microsoft recommends mapping certificate dependencies and trust relationships, assessing vendor readiness, and identifying long-lived infrastructure.
- Organizations should establish non-production tests and use the results to plan a multi-year transition.
Article Details
- Event Type
- Microsoft launched the PQC TLS Pilot Program to let eligible certificate authorities test post-quantum certificate issuance and interoperability in controlled environments.
- Impact
- The pilot supports non-production testing of compatibility, performance, and operational readiness for post-quantum authentication. Its certificates are not publicly trusted and must not be used for production trust scenarios or public-facing websites; ML-DSA support remains limited and evolving.
Vendors
ComSignMicrosoft Trusted Root Program Annoucement, the August 2026 release added seven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.DigiCertTrusted Root Program Annoucement, the August 2026 release added seven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.HARICARoot Program Annoucement, the August 2026 release added seven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.IdenTrust ServicesAnnoucement, the August 2026 release added seven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.MicrosoftMicrosoft's perspective on readinessSectigoAugust 2026 release added seven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.Shanghai Electronic Certification Authorityseven pilot roots operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.SSL.comComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.