Post-quantum authentication: Why organizations should start testing certificate ecosystems now

What it is

Microsoft's PQC TLS Pilot Program, launched August 27, 2026, lets certificate authorities already approved in the Microsoft Trusted Root Program test issuance of ML-DSA-87 (Module-Lattice-Based Digital Signature Algorithm) certificates under controlled, non-production conditions.

Preconditions / Affected

• Participating CAs must already be in good standing with the Microsoft Trusted Root Program; this is not an open pilot.
• Seven roots were added in the August 2026 release, operated by ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.
• Rolling admissions continue through end of 2026 for other eligible CAs in the Trusted Root Program.
• On the client side, evaluation requires Windows 11 26H1 with KB5101681 (OS Build 28000.2608) or 25H2 with KB5101684 (OS Builds 26200.8973/26100.8973), both released July 28, 2026. ML-DSA certificates can be exercised via Schannel under supported configurations.
• Certificates issued under the pilot are explicitly not publicly trusted — they must not be used for production trust or public-facing websites, and ML-DSA support is described as limited and evolving.

What to do

• Ask your certificate provider directly whether it participates in the pilot and what testing it offers; if your CA is in the Trusted Root Program but not yet in the pilot, the article suggests encouraging them to apply via the admissions process at aka.ms/rootcert.
• To test client-side handling, apply the specific July 28, 2026 Windows 11 KBs above and validate Schannel behavior with ML-DSA-87 certs in a closed, non-production environment — not against production endpoints.
• Use the pilot specifically to probe handshake size growth, performance effects of larger PQC certificate chains, HSM readiness, and whether network inspection/monitoring tooling chokes on the new chain sizes — these are named as the concrete unknowns the pilot is meant to surface.

Caveats

• Pilot-issued certs are confined to closed environments and custom test applications; the page is explicit that no production or public-facing use is supported.
• ML-DSA-87 support is stated as "limited and evolving" during the pilot, so results obtained now may not reflect eventual GA behavior.
• The six-step readiness plan and pilot participation are presented as Microsoft's own recommended path — the page does not cite independent validation of timelines or algorithm choice.