Let’s Encrypt, the free certificate authority operated by the nonprofit Internet Security Research Group, said on June 3, 2026, that it plans to issue Merkle Tree Certificates, or MTCs, for post-quantum authentication on the web. The organization is “planning to support Merkle Tree Certificates as the path forward for the post-quantum Web PKI,” Andrew Gabbitas wrote in a post on its blog.
A Merkle Tree Certificate is one entry in a large batch of certificates that an authority signs once, using a hash structure called a Merkle tree. A browser that already has the batch signature can check the certificate with a short inclusion proof showing that it belongs to the batch, instead of verifying several large signatures.
Let’s Encrypt is “targeting late 2026 for a staging environment that issues MTCs, and 2027 for a production-ready environment,” Gabbitas wrote. A staging environment is a test service that developers use before a production service opens. Both dates are targets, and he wrote that “the transition will take time,” with standards and root-program requirements still being settled.
He wrote that nothing changes today for subscribers, whose current certificates “will continue to be issued and renewed exactly as they always have been.”
A certificate authority issues the digital certificates that browsers use to confirm they have reached the right website. The Web PKI is the name for the authorities, certificates, and browsers involved in that check across the public internet. Root programs are the policies under which browser and operating-system makers decide which certificate authorities to trust.
Deadlines and certificate size
Gabbitas cited Google’s announcement that it would migrate its services by 2029, as well as Cloudflare’s parallel commitment. He also cited a European Union roadmap with a target of the end of 2030 for high-risk systems, along with NIST’s draft transition guidance of November 2024. In that draft, NIST proposed deprecating 112-bit-strength algorithms such as RSA-2048 after 2030 and disallowing quantum-vulnerable algorithms, including P-256, after 2035.
Signatures under ML-DSA, the NIST post-quantum signature standard derived from CRYSTALS-Dilithium, are much larger than today’s. Gabbitas put an ML-DSA-44 signature at roughly 2,420 bytes, against 256 bytes for RSA-2048 and 64 bytes for ECDSA-P256.
A TLS handshake is the exchange of messages at the start of an encrypted web connection. With ML-DSA equivalents for its signatures and keys, a single handshake would grow “well past 10 kilobytes,” Gabbitas wrote. Citing Cloudflare research, he wrote that “a meaningful share of TLS connections fail on real-world networks” at that scale.
In the MTC design, Gabbitas wrote, an authority “issues certificates in batches, with a single signature covering the entire batch.” Browsers receive those batch signatures, called landmarks, separately from the TLS handshake.
In the common case, he wrote, “the entire authentication path in an MTC handshake is one signature, one public key, and one inclusion proof.” Browsers with out-of-date landmarks would get slightly larger handshakes as a fallback.
What exists and what is planned
Let’s Encrypt has operated Certificate Transparency logs, public append-only records of issued certificates, since 2019. “Certificate Transparency is built in” to the MTC design, Gabbitas wrote.
ACME is the protocol that subscribers’ software uses to request certificates. Gabbitas called the MTC project “not a small endeavor” and listed changes needed to Let’s Encrypt’s issuance systems, the ACME protocol, revocation and operational tooling, and transparency-log systems.
Let’s Encrypt has also been “participating in the IETF PLANTS and ACME working groups as the standards take shape,” he wrote. PLANTS stands for PKI, Logs, And Tree Signatures.
The staging and production environments, and the changes to ACME and revocation that they require, are plans. The Certificate Transparency logs and the standards work already exist.
Browsers and standards
Let’s Encrypt cited Chrome’s February 27 announcement that MTCs are its preferred path for adding post-quantum certificates to the public web. In that announcement, Chrome’s Secure Web Networking Team wrote that Chrome has “no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store.”
X.509 is the format of today’s web certificates. The Chrome Root Store is the list of certificate authorities that Chrome trusts.
The Chrome team described a new Chrome Quantum-resistant Root Store and a corresponding root program “that only supports MTCs,” under a phase it dated to the third quarter of 2027. Let’s Encrypt also cited a feasibility experiment that Cloudflare and Chrome are running.
The IETF’s PLANTS working group is developing the MTC specification as an Internet-Draft, a working document that is not yet a standard. The draft’s authors posted revision -04 of draft-ietf-plants-merkle-tree-certs on May 24, 2026.
For X.509 certificates, Let’s Encrypt is “tracking the standards for ML-DSA signatures in X.509,” Gabbitas wrote, citing RFC 9881 and draft-ietf-tls-mldsa. The IETF published RFC 9881 in October 2025 to define identifiers for ML-DSA in X.509 certificates. In draft-ietf-tls-mldsa, IETF authors specify how to use ML-DSA in TLS 1.3.
Advice to operators
Let’s Encrypt asked server operators to support hybrid post-quantum key exchange, X25519MLKEM768. In that scheme, a classical algorithm is paired with ML-KEM, the NIST standard derived from CRYSTALS-Kyber. Gabbitas wrote that “any TLS connection without post-quantum key exchange is potentially harvestable for later decryption.”
“Some of the changes coming will require client-side support,” Gabbitas wrote, asking maintainers of ACME clients to follow the PLANTS working group and the [email protected] mailing list. Let’s Encrypt’s next milestone is the staging environment it is targeting for late 2026.
Update, November 13, 2026: NIST published the final IR 8547 on October 27. NIST wrote that it “will instead deprecate all quantum-vulnerable digital signature algorithms after 2030,” a group that includes ECDSA with P-256. On November 5, Let’s Encrypt announced more than €1 million in funding from the Sovereign Tech Agency, running through 2027, to build an MTC certificate authority, without new target dates.
