The Apple Root Program, the body that decides which root certificates Apple’s operating systems trust, announced on September 21, 2026, that it is establishing a policy for Merkle Tree Certificates (MTCs) in TLS server authentication. For S/MIME, the standard for signed and encrypted email, Apple is also amending its root program policy to accept traditional X.509 root certificates that use composite algorithms, combinations of a post-quantum algorithm and a classical one.
Dustin Hollenback of Apple posted the announcement to a Chromium mailing list on Certificate Transparency policy. Apple expects to publish a draft MTC policy by the end of October 2026 and to begin accepting applications from MTC certificate authority operators by late summer 2027.
Apple described the MTC design as replacing “massive PQC signatures with a new compact signature scheme” that also provides issuance transparency, a public record of the certificates issued.
Devon O’Brien of Apple and four co-authors from Google, Cloudflare, and Geomys defined MTCs in an Internet-Draft for the IETF’s PLANTS working group as “a new form of X.509 certificates which integrate public logging of the certificate.” The IETF has not published the draft as a standard.
Certificate size in TLS
Apple wrote that post-quantum certificate chains are “roughly an order of magnitude larger than the classical chains they replace,” because the handshake that opens a TLS connection typically includes five signatures and two public keys. ML-DSA, formerly CRYSTALS-Dilithium, is the post-quantum signature algorithm that NIST standardized in FIPS 204 in 2024. According to Apple, “significant degradation of TLS handshakes in real-world deployments” had occurred in experiments with ML-DSA in traditional X.509 hierarchies.
Expected MTC requirements
Apple expects the draft to require three cosignatures per certificate, each a signature over the public log that records the certificate’s issuance. The issuing operator would supply two of them, an ML-DSA cosignature and a classical one, with ML-DSA-44 and ECDSA-P256-SHA256 as the minimums. A different operator acting as a mirror, keeping its own copy of the log, would add a second ML-DSA cosignature. Apple wrote that clients must receive periodic out-of-band updates to use the short proofs, or fall back to larger post-quantum certificates.
Operators would need to keep all cosigner keys in hardware security modules, tamper-resistant devices that store cryptographic keys. The modules would have to be validated to FIPS 140-3 Level 3 or Common Criteria EAL 4+.
Operators would register Private Enterprise Numbers with IANA, the internet’s central numbering authority, and use them as the basis for Trust Anchor Identifiers, short labels for trusted roots.
Certificates would be valid for no more than seven days. Operators would undergo an annual audit and publish “far more non-private operational detail, including a record for every domain validation.” A certificate authority, the organization that issues a certificate, performs domain validation to confirm that an applicant controls a web domain.
Email certificates
Apple wrote that S/MIME has lower certificate issuance volume than TLS and is less sensitive to delays, so larger post-quantum certificates would be less disruptive to existing X.509 infrastructure. It will accept root certificates signed with composite algorithms that combine ML-DSA with ECDSA or RSA in one certificate.
Apple wrote that the ML-DSA component provides security against quantum attacks. The classical component, it wrote, “keeps the system verifiable using an algorithm with decades of deployment experience.”
Next steps
Apple plans to post the draft MTC policy in its root program’s GitHub repository and then run a public feedback survey. It said it may also set up a test phase for MTCs and would then explain which requirements apply and how to take part.
Update, November 12, 2026: As of November 12, Apple had not posted a draft MTC policy in its root program’s GitHub repository. The IETF draft reached its eighth revision on November 2 and is still an Internet-Draft.
