What are Merkle Tree Certificates (MTCs)?

The quantum threat is real. Adversaries are already stealing and storing encrypted data today in hopes that future quantum computers will be able to decrypt it—a strategy known as harvest now, decrypt later. As a result, post-quantum cryptography (PQC) has shifted from a research topic to migration mandate.

While quantum-resistant algorithms solve the cryptographic problem, they introduce a practical one: much larger keys and signatures. If deployed through today's public key infrastructure (PKI), they would inflate every secure connection, driving up bandwidth, processing, and storage costs across the internet. Mobile users and high-latency networks would feel it most, but some systems like legacy web servers and load balancers might break completely.

Recognizing these limits, cryptographers from across the industry, including teams at Google, Cloudflare, with contributions from Sectigo, have been developing a new approach. Merkle Tree Certificates (MTCs) do not force large post-quantum signatures into an infrastructure that wasn't designed for them, they instead rethink how certificates are built and delivered for the post-quantum era. 

What is a Merkle Tree Certificate?

An MTC is a new approach to digital certificates that dramatically reduces the amount of data exchanged during a secure connection. Instead of signing every certificate individually and sending a full chain with every handshake, a certificate authority batches the certificates it issues into a single structure called a Merkle tree. The authority signs the tree rather than each certificate, and browsers receive the trusted tree heads ahead of time through transparency infrastructure. The elements of the tree that are signed are hash summaries, which in themselves are quantum-resistant.

When a browser connects to a website, the site presents a short proof, just a handful of hashes, showing that its certificate belongs to a tree the browser already trusts. The heavy chain of signatures never crosses the wire. That difference matters at post-quantum scale. A single ML-DSA signature weighs roughly 2.4 kilobytes, and a conventional chain would carry several of them plus transparency artifacts. The Merkle proof that replaces them typically comes in under a kilobyte.

MTCs will likely coexist with the certificates we use today.  Anticipate a future where quantum-resistant methods stay efficient, transparent, and compatible with the web as it exists right now. 

Why do Merkle Tree Certificates matter for the internet?

PKI is ubiquitous in all of our technology stacks. Cloud applications, AI-driven workloads, and billions of connected devices all depend on fast, constant TLS handshakes. If post-quantum authentication slows those handshakes down, everyone feels it. MTCs matter because they remove that tradeoff in two important ways.

1. Merkle Tree Certificates help keep the internet fast

Forcing traditional post-quantum signatures onto public websites would balloon handshake sizes and degrade the user experience, especially on mobile and high-latency connections. MTCs sidestep the problem by replacing multiple large signatures with one compact inclusion proof, holding overhead close to what users experience today. We get to keep using the internet exactly the way we do now, fast and uninterrupted, with quantum resistance underneath.

2. Merkle Tree Certificates make transparency part of the design

In today's PKI, Certificate Transparency (CT) logging is bolted onto the side of issuance as a separate step. When logging fails, a certificate can sit out in the wild unnoticed, creating a security blind spot.

MTCs invert that relationship. The act of creating a certificate is the act of logging it. If a certificate is not in the tree, it simply does not exist. That matters because authentication in a post-quantum world cannot be truly secure without total visibility, and MTCs make the two inseparable. 

Our vision: Sectigo and Merkle Tree Certificates

The momentum behind this shift is real and measurable. Browsers have signaled that MTCs are their preferred path for bringing post-quantum certificates to the public web, and feasibility experiments are already running against live internet traffic. Sectigo believes MTCs represent the most promising route to post-quantum authentication that preserves the performance and scalability organizations depend on today.

At the same time, we continue to track the broader post-quantum ecosystem, from NIST-standardized algorithms such as ML-DSA to evolving IETF specifications, browser roadmap decisions, and enterprise adoption requirements. The full scope of what MTCs can do is still coming into focus. What is already clear is that organizations need visibility, automation, and crypto agility to adapt as standards mature. Sectigo remains committed to helping customers prepare for that future, whatever shape the underlying certificate architecture takes.