What Comes After X.509

2026-02-27

X.509 certificates have run the web for three decades. Quantum computers might be what finally kills them. Google announces they don't have immediate plans to add support for post-quantum secure X.509 certificates in Chrome in favor of a newer standard.

Post-quantum encryption has long arrived in browsers and a large fraction of internet traffic already uses post-quantum secure hybrid key exchanges. However on the authentication side, we still rely on signatures that would be vulnerable to attacks from quantum computers, which is why Google is now looking beyond X.509 entirely, experimenting with an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), an IETF draft being developed in the newly formed PLANTS working group (PKI, Logs, And Tree Signatures).

We're likely going to see a shift away from X.509 PKIs in the future. MTCs replace the heavy serialized chain of signatures in traditional PKI with compact Merkle Tree inclusion proofs. A CA signs a single "Tree Head" covering potentially millions of website certificates, and browsers receive a lightweight proof of inclusion rather than the full chain. This allows for post-quantum secure authentication without the massive bandwidth penalty classical X.509 chains would incur with PQ algorithms. MTCs will likely even reduce handshake sizes compared to today's non-PQ certificates and be faster since ML-DSA signature verification speed is comparable to ECDSA, and far fewer signatures need to be verified per handshake. And it also has built-in Certificate Transparency (CT).

However it's not all roses with MTCs. The current system can issue new certificates in seconds to minutes, for example through the ACME protocol which is deployed by Let's Encrypt among others. With MTCs, users have to wait until a whole batch of certificates is signed by a CA, which can take up to an hour. To mitigate this, servers could advertise MTC support via a TLS extension and fall back to presenting a traditional X.509 certificate when the client doesn't have the right tree head yet, which would allow for a more gradual and safe transition. Another open question is how intermediate certificates will be handled by MTCs, which is still marked as TODO in the IETF draft.

With these limitations, MTCs still being in their infancy and given the pace at which we transition cryptography (I still see way too many TLS 1.0 deployments in the wild), X.509 certificates are likely staying with us for decades, but we're finally laying the groundwork for what comes after.

Comment or Share on