Summary
- Microsoft's 8 October research identifies authentication dependencies beyond encrypted transport.
- Its controlled TLS pilot supports testing of ML-DSA-87 certificates, not production trust.
- Certificate authorities, enterprise PKI teams and hardware vendors will need coordinated migration planning.
Microsoft has urged organisations to begin testing post-quantum authentication across their certificate infrastructure, warning that cryptographic migration will affect far more than the algorithms protecting data in transit.
In technical guidance published on 8 October 2026, Microsoft Security Research describes the potential impact on public key infrastructure, trust anchors, application validation, hardware security modules, network inspection and enterprise certificate-management processes. Its message is that organisations need to discover and test dependencies before future certificate requirements affect production systems.
Much of the discussion around post-quantum cryptography has concerned the possibility that encrypted data collected today could later be decrypted using future quantum computers. Authentication presents a separate problem: systems must determine whether a certificate, digital signature or issuing authority can be trusted, often across several layers of interconnected software and hardware.
Changing a signature scheme could affect certificate size, chain validation, handshake performance, storage requirements and the assumptions made by custom applications. A system may support a new cryptographic algorithm yet fail when a certificate chain exceeds a fixed buffer, when an inspection tool rejects an unfamiliar signature or when a device has hard-coded expectations about trusted authorities.
Microsoft launched a Post-Quantum Cryptography TLS Pilot Program on 27 August 2026. Its controlled trial lets eligible certificate authorities evaluate root certificates and issuance using ML-DSA-87, a quantum-resistant digital signature algorithm. The certificates produced through the pilot are not publicly trusted and must not be used for public-facing production websites.
Seven certificate authority operators joined the initial pilot roots, including DigiCert, Sectigo, SSL.com and several other providers. Microsoft says the programme will admit further eligible participants through the end of 2026 as it examines how certificates behave across platforms and applications.
Supported and appropriately configured Windows 11 environments can participate in non-production tests using platform updates introduced in July 2026. Microsoft also describes supported Schannel evaluation scenarios, while cautioning that platform prerequisites must be checked. These capabilities should not be confused with a general production rollout of quantum-resistant certificate trust.
The operational challenge is particularly pronounced for organisations that have accumulated internal certificate authorities, embedded devices, industrial controllers and bespoke software over many years. Such systems may depend on trust decisions that are poorly documented or difficult to alter without coordinated vendor development.
Microsoft recommends inventories of certificate-dependent services, maps of trust relationships, vendor readiness reviews and isolated test environments. The work should extend beyond web certificates to machine identities, appliances and services that issue or validate credentials automatically.
The guidance frames authentication migration as a multi-year programme rather than a single scheduled upgrade. Test results will help establish which applications or devices need changes before a future production requirement. The immediate development is the availability of a structured test programme and more explicit vendor guidance, not a claim that existing enterprise certificates have ceased to function.
Certificate-based authentication relies on more than the ability of one application to verify a new cryptographic signature. Chains of trust can span certificate authorities, hardware devices, browsers, application libraries and operational tooling. If a new signature algorithm is accepted by a test component but rejected by a downstream relying party, a nominally successful cryptographic pilot can still fail at the service level. Microsoft’s stated emphasis is therefore on compatibility testing across the ecosystem.
The distinction between a controlled pilot and general public trust is also essential. Experimental ML-DSA certificates should not be characterised as universally supported production credentials, and organisations cannot assume that an isolated cryptographic library update will complete migration. The current announcement provides testing guidance and a technical direction; it does not establish a mandated enterprise migration date or guarantee interoperability across existing devices.
