Building a post-quantum certificate authority with Merkle Tree Certificates

Web Public Key Infrastructure relies on browsers, certificate authorities, and certificate transparency logs to verify website identities, but the expected transition to post-quantum cryptography by 2029 poses major scaling challenges because post-quantum signatures are far larger than current signatures. Merkle Tree Certificates (MTCs), an emerging IETF design, aim to address this by integrating certificate issuance with append-only transparency logs, allowing certificate authorities to sign batches of certificates through Merkle-tree checkpoints while clients verify compact inclusion proofs. Cloudflare plans to support free MTC issuance through its new certificate authority, with a target of inclusion in Chrome’s Quantum-resistant Root Store in early 2027, while also operating transparency-log mirrors and requiring independent cosigning. In an experiment with Chrome Beta involving billions of certificate deliveries, landmark-relative MTCs reduced handshake data and achieved median performance 9% faster than traditional certificate chains, although standalone fallbacks remain necessary for offline or newly installed clients. Wider deployment will still require independent monitoring, diverse certificate authorities and cosigners, browser support, and rigorous evaluation of Cloudflare’s CA by Chrome’s root program.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.