Let’s Encrypt has unveiled a new approach to securing the web against future quantum threats: Merkle Tree Certificates (MTCs), a post-quantum–ready certificate model designed to maintain the speed and reliability of today’s TLS ecosystem.
As the industry moves closer to the reality of cryptographically relevant quantum computers (CRQCs), the focus is shifting beyond encryption to authentication, where attackers could potentially forge digital signatures in real time.
Global directives from NIST, the NSA, and the European Union have already set aggressive timelines to phase out traditional cryptographic algorithms like RSA-2048 and ECDSA by 2035, while companies such as Google and Cloudflare aim to transition even earlier, around 2029.
Let’s Encrypt Introduces Merkle Tree Certificates
One of the biggest challenges in adopting post-quantum cryptography in the Web PKI is the significant increase in data size. Post-quantum algorithms like ML-DSA produce signatures that are several kilobytes long, compared to just a few hundred bytes in current standards.
When applied to a typical TLS handshake, this increase can push total data sizes beyond 10 KB, resulting in slower connections and higher failure rates, particularly on unreliable networks. This makes a direct replacement of existing cryptographic schemes impractical at scale.
To address this, Merkle Tree Certificates introduce a fundamentally different design. Instead of signing each certificate individually, certificate authorities batch multiple certificates into a Merkle tree and sign the entire structure once.
During a TLS handshake, the client only needs a compact inclusion proof, along with a single signature and public key, to verify authenticity. Browsers periodically fetch signed tree checkpoints, known as landmarks, outside the handshake process, reducing real-time overhead.
This approach not only minimizes handshake size but can even make it smaller than current implementations, despite using post-quantum algorithms.
MTCs also integrate transparency directly into the certificate issuance process. Unlike today’s Certificate Transparency system, which logs certificates after they are issued, MTCs ensure that every certificate is inherently part of a publicly verifiable Merkle tree.
This eliminates the need for additional logging proofs and strengthens trust in the ecosystem. Let’s Encrypt’s prior experience operating large-scale Certificate Transparency logs gives it a strong foundation for deploying this model.
Industry support for MTCs is already growing. Cloudflare and Google Chrome are actively testing the model in real-world environments, and the IETF’s PLANTS working group is developing the necessary standards.
Chrome has also indicated that MTCs are its preferred approach for introducing post-quantum certificates to the web. Let’s Encrypt plans to launch a staging environment for MTCs by late 2026, followed by a production rollout in 2027. However, this will require significant updates to ACME clients, issuance pipelines, and supporting infrastructure.
For now, there is no immediate impact on users or administrators, as existing certificates will continue to function normally. However, the broader transition to post-quantum security is already underway, and organizations are advised to prioritize hybrid key exchange mechanisms such as X25519MLKEM768 to mitigate long-term risks.
MTCs represent a scalable and efficient path forward, enabling the Web PKI to evolve toward quantum-resistant authentication without compromising performance or reliability.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
.){kind=link}