--- url: "https://www.xcademia.com/news/microsoft-urges-organizations-to-test-post-quantum-certificate-systems" title: "Microsoft Urges Organizations to Test Post-Quantum Certificate Systems" description: "Microsoft urges organizations to test post-quantum authentication, assess certificate dependencies, and prepare PKI systems through controlled PQC testing." publishedAt: "2026-10-09T11:14:00.716+00:00" updatedAt: "2026-10-11T23:01:48.089533+00:00" type: news category: cybersecurity source_name: Microsoft Security Blog source_url: "https://www.microsoft.com/en-us/security/blog/2026/10/08/post-quantum-authentication-why-organizations-should-start-testing-certificate-ecosystems-now/" tags: - "#PostQuantumCryptography" - "#PostQuantumAuthentication" - "#Cybersecurity" - "#PKI" - "#TLS" - "#QuantumComputing" - "#MicrosoftSecurity" - "#DigitalCertificates" --- # Microsoft Urges Organizations to Test Post-Quantum Certificate Systems > Microsoft is urging organizations to test post-quantum authentication before wider adoption. Its PQC TLS Pilot Program helps eligible certificate authorities evaluate certificate interoperability, compatibility, performance, and operational readiness in controlled environments. Source: **Microsoft Security Blog** · 9 October 2026 **M**icrosoft is encouraging organizations to begin testing post-quantum authentication systems as part of their preparations for future cryptographic changes. In a research post published on October 8, 2026, Microsoft Security Research outlined why certificate ecosystems, public key infrastructure (PKI), applications, devices, and hardware security systems need early evaluation. The guidance focuses on a challenge that can receive less attention than protecting encrypted data: ensuring that systems can continue to establish trust and authenticate connections as cryptographic algorithms evolve. Microsoft's Post-Quantum Cryptography (PQC) Transport Layer Security (TLS) Pilot Program gives eligible certificate authorities an opportunity to evaluate post-quantum certificate issuance and interoperability in controlled environments. The company recommends that organizations begin by inventorying certificate dependencies, assessing vendor readiness, identifying long-lived infrastructure, and establishing non-production environments for testing. ## Why Post-Quantum Authentication Requires Preparation Post-quantum cryptography is designed to help protect cryptographic systems against threats from future quantum computers capable of breaking some of the public-key cryptography used today. Many preparation efforts focus on confidentiality and the risk known as "harvest now, decrypt later." In this scenario, an adversary collects encrypted information today in the hope of decrypting it when sufficiently capable quantum computing becomes available. Authentication presents a different set of challenges. Authentication systems rely on certificates, private keys, trust anchors, certificate authorities, and software that validates digital identities. These components must work together across applications, devices, networks, and vendors. Changing cryptographic algorithms can therefore affect more than the underlying mathematics. It can also affect certificate issuance, distribution, storage, validation, renewal, and management. Microsoft points out that organizations may understand where TLS protects their communications without having a complete inventory of every system that issues, stores, validates, or depends on certificates. That visibility gap can make it difficult to understand the full scope of a future migration. ## ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791544122700-info-1--205-.webp) ## Why Organizations Should Start Testing Now Post-quantum authentication is unlikely to be a single, straightforward technology upgrade. Enterprise environments often contain legacy applications, internally managed PKI deployments, embedded devices, operational technology, security appliances, third-party services, and hardware-backed trust systems. Some systems have long deployment lifecycles or technical constraints that may only become apparent during testing. Organizations need to determine how post-quantum certificate hierarchies will interact with their existing infrastructure. Microsoft highlights several questions that organizations should investigate: - Can existing applications process and validate post-quantum certificates correctly? - How could larger certificates and certificate chains affect handshake size, performance, storage, transmission, and inspection limits? - Will existing PKI workflows need changes to support new algorithms? - Can network monitoring, inspection, and certificate-management systems handle post-quantum authentication? - Are hardware security modules and other cryptographic components ready for future certificate requirements? - Which dependencies exist across vendors, supply chains, and third-party services? These questions cannot be answered through cryptographic planning alone. Organizations need to test the interactions between certificates, software, infrastructure, and operational processes. Early testing can help expose compatibility gaps and identify systems that may require modernization before broader deployment becomes necessary. ## Microsoft's PQC TLS Pilot Program Microsoft launched its PQC TLS Pilot Program on August 27, 2026, to help the certificate ecosystem gain practical experience with post-quantum authentication. The program allows approved certificate authorities in good standing with the Microsoft Trusted Root Program to evaluate post-quantum TLS roots and certificate issuance using **ML-DSA-87**, a post-quantum digital signature algorithm specified in NIST's FIPS 204 standard. The program is intended to help participants evaluate: - Interoperability between certificate chains and supported platforms - Compatibility with applications and existing infrastructure - Performance considerations associated with post-quantum certificates - Certificate issuance and operational workflows - Readiness across the wider certificate ecosystem The pilot is designed to help participants identify problems rather than assume that existing infrastructure is already compatible. ### Pilot certificates are not for production use Microsoft makes an important distinction between testing readiness and deploying post-quantum authentication in production. Certificates issued through the pilot are **not publicly trusted**. They are intended for interoperability and ecosystem-readiness testing in closed environments, custom applications, and enterprise testbeds. They must not be used for production trust scenarios or public-facing websites. Microsoft also states that ML-DSA support remains limited and evolving during the pilot and should not be relied upon for production use. Organizations should therefore treat the program as a controlled testing opportunity, not as a general-purpose replacement for their current production certificate infrastructure. ## Seven Certificate Authority Roots Added to the Pilot According to the Microsoft Trusted Root Program announcement, the August 2026 release added seven pilot roots operated by the following certificate authorities: - ComSign - DigiCert - HARICA - IdenTrust Services - Sectigo - Shanghai Electronic Certification Authority - [SSL.com](http://SSL.com) Microsoft said the pilot would continue with rolling admissions through the end of 2026, providing further opportunities for eligible certificate authorities participating in the Microsoft Trusted Root Program to apply. Organizations interested in the program should review the requirements and application process through the [Microsoft Trusted Root Program](https://aka.ms/rootcert). They can also contact their certificate providers to ask whether they participate in the pilot and whether suitable testing opportunities are available. ## Windows 11 and Schannel Support for Testing Microsoft also describes support for evaluating ML-DSA certificates on supported and appropriately configured Windows 11 systems. According to the source, support begins with the July 28, 2026 updates: - **Windows 11, version 26H1:** [KB5101681, OS Build 28000.2608](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/07/july-28-2026-kb5101681-preview) - **Windows 11, versions 25H2 and associated builds:** [KB5101684, OS Builds 26200.8973 and 26100.8973](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/07/july-28-2026-kb5101684-preview) The source also states that ML-DSA certificates can be used with Secure Channel (Schannel) in supported scenarios. Organizations should confirm the applicable Windows and Schannel requirements before beginning tests. The source does not establish that every Windows configuration, application, or certificate workflow supports ML-DSA. Within appropriate non-production environments, these capabilities can help teams investigate application compatibility, certificate-size constraints, performance effects, and operational workflow gaps. The purpose is to gather practical evidence about how post-quantum authentication behaves in a specific environment before considering broader deployment. ## ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791544142411-info-2--187-.webp) ## What Organizations Can Do Today Microsoft recommends that security leaders, PKI administrators, and architects begin preparing even if broad post-quantum adoption is not yet part of their immediate deployment plans. The following steps translate the source's recommendations into a practical preparation framework. ### 1. Inventory certificate-dependent systems Identify applications, services, devices, security appliances, and infrastructure that depend on certificates for authentication or trust establishment. Include systems that issue, distribute, validate, store, renew, or manage certificates. An inventory limited to internet-facing TLS endpoints may not reveal every internal dependency. ### 2. Map certificate and trust relationships Document public and private PKI environments, including internal certificate hierarchies, trust anchors, device authentication systems, and externally managed certificates. The objective is to understand how trust is established across the organization and which systems could be affected by changes to certificate algorithms or formats. ### 3. Assess vendor readiness Contact certificate providers, PKI vendors, hardware security module providers, software vendors, and platform providers. Ask about their post-quantum roadmaps, supported testing options, compatibility requirements, and plans for addressing dependencies. Avoid assuming that all vendors or products are at the same stage of readiness. ### 4. Identify long-lived infrastructure Pay particular attention to embedded devices, operational technology, security appliances, and systems with lengthy upgrade cycles. These environments may require more preparation because their replacement, testing, or maintenance schedules can differ from those of regularly updated software. ### 5. Establish safe test environments Create non-production environments where post-quantum certificate hierarchies can be evaluated without affecting production trust. Use these environments to investigate interoperability, certificate-chain handling, performance, application compatibility, and operational processes. Where appropriate, eligible organizations can explore the Microsoft PQC TLS Pilot Program through participating certificate authorities. ### 6. Build a multi-year readiness roadmap Treat post-quantum authentication as a coordinated program rather than a one-time upgrade. Assign responsibility for certificate inventory, vendor engagement, testing, and remediation planning. Use test findings to prioritise work and revisit the roadmap as standards and platform support evolve. Microsoft also recommends that organizations ask their certificate providers whether they participate in the pilot and whether they can offer testing opportunities suited to the organization's environment. ## ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791544160898-info-3--175-.webp) ## What This Means for Enterprise Security Teams Microsoft's guidance highlights that post-quantum preparation involves more than choosing a new cryptographic algorithm. Organizations need to understand how certificate authorities, applications, operating systems, devices, PKI workflows, and hardware interact. A certificate may be cryptographically appropriate while still exposing compatibility or operational issues in a particular environment. For enterprises, early testing could provide a clearer view of which dependencies need attention, which vendors require follow-up, and which systems may need longer-term modernization. The practical value of the pilot is the opportunity to identify those issues in a controlled setting. Its certificates are not intended for production use, and the source does not establish a universal migration deadline or claim that all enterprise systems are already compatible. ## Conclusion Microsoft is urging organizations to begin testing post-quantum authentication now rather than waiting until broader adoption creates pressure to migrate. Its PQC TLS Pilot Program provides eligible certificate authorities with a controlled environment to evaluate ML-DSA-based certificate issuance and ecosystem interoperability. Supported Windows 11 and Schannel scenarios also provide opportunities for appropriately configured environments to conduct non-production testing. For enterprise security teams, the immediate priorities are clear: inventory certificate dependencies, map trust relationships, engage vendors, identify long-lived infrastructure, and build a safe testing strategy. The wider transition will involve multiple technologies and operational processes. Organizations that investigate their dependencies early can use real test results to inform planning as post-quantum authentication support continues to evolve. ## Original source https://www.microsoft.com/en-us/security/blog/2026/10/08/post-quantum-authentication-why-organizations-should-start-testing-certificate-ecosystems-now/ ## Tags `#PostQuantumCryptography` · `#PostQuantumAuthentication` · `#Cybersecurity` · `#PKI` · `#TLS` · `#QuantumComputing` · `#MicrosoftSecurity` · `#DigitalCertificates` --- ## About this content This Markdown news article is the citation-grade twin of [Microsoft Urges Organizations to Test Post-Quantum Certificate Systems](https://www.xcademia.com/news/microsoft-urges-organizations-to-test-post-quantum-certificate-systems). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/microsoft-urges-organizations-to-test-post-quantum-certificate-systems - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt