PKI administrators are asking, "When do we need to care about post-quantum cryptography?" and "What can we do about it right now?" The answer to both is more practical than you might expect.
These questions come from teams managing certificate lifecycles, trust hierarchies, and authentication infrastructure who've heard the warnings about quantum computing but haven't seen clear guidance on what testing looks like today. Microsoft's PQC TLS Pilot Program, launched on August 27, 2026, provides a controlled environment to answer those questions with actual implementations rather than theoretical discussions.
Do I Need to Inventory Every Certificate Dependency Right Now?
Yes, and not because there's an imminent deadline.
You need the inventory because you don't know what's going to break when certificate sizes increase or when algorithms change. The goal isn't to fix everything today; it's to understand what you're working with before you're forced to migrate under pressure.
Start with systems that issue, validate, store, or distribute certificates. That includes your internal PKI if you run one, but also security appliances, network inspection tools, IoT devices, operational technology, embedded systems, and any hardware security modules in your environment.
The systems you can't easily upgrade are the ones you need to find first. If you've got a security appliance with a five-year replacement cycle or embedded devices that authenticate via certificates, those are your constraint points. Map those before you worry about servers you can patch monthly.
What Exactly Am I Testing with Pilot Certificates?
You're testing whether your environment can handle post-quantum certificate chains without issues.
Certificates issued through the pilot use ML-DSA-87 (Module-Lattice-Based Digital Signal Algorithm). They're not publicly trusted and they're not meant for production. They exist so you can validate interoperability, spot compatibility gaps, and identify performance constraints in a controlled setting.
The practical questions you're answering:
- Can your applications correctly process and validate these certificates?
- Do larger certificate chains cause handshake failures, timeout issues, or storage problems?
- Will your network monitoring or inspection systems choke on the increased size?
- Do your PKI workflows need changes to accommodate new algorithms?
- Are your HSMs ready to support future certificate requirements?
If you're running supported Windows 11 systems (KB5101681 for OS Build 28000.2608 on 26H1, or KB5101684 for OS Builds 26200.8973 and 26100.8973 on 25H2, both from July 28, 2026), you can test ML-DSA certificates in non-production scenarios. Schannel support is available in specific configurations; confirm platform requirements before testing.
Should We Push Our Certificate Provider to Join the Pilot?
If they participate in the Microsoft Trusted Root Program, yes.
Seven certificate authorities joined the initial August 2026 release: ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com. The pilot continues with rolling admissions through the end of 2026.
Your leverage here is straightforward: you're a customer evaluating long-term vendor readiness. If your provider isn't participating, ask them about their post-quantum roadmap and whether they plan to apply. If they don't have a clear answer, that's useful information for your own planning.
Certificate authorities who participate gain early experience with operational processes, interoperability challenges, and ecosystem readiness. Providers who wait are making a choice about their readiness timeline, and you should factor that into your risk assessment.
How Do I Convince Leadership This Matters?
Frame it as constraint identification, not compliance.
The risk isn't that quantum computers will break your authentication next quarter. The risk is that when post-quantum authentication becomes necessary, you'll discover infrastructure dependencies you can't quickly change. Leadership understands operational constraints better than cryptographic theory.
Walk through what happens if you need to migrate authentication systems and you haven't inventoried dependencies: you'll find devices that can't be upgraded, vendors who haven't published roadmaps, HSMs that need replacement, and applications with hard-coded certificate size limits. Each of those discoveries adds months to your timeline.
Testing now means you identify those constraints when you have time to plan, budget, and sequence the work. Testing later means you're doing emergency procurement and architectural rework under deadline pressure.
What's the First Step If We're Starting from Zero?
Document your trust relationships.
Map every PKI environment you operate or depend on: internal certificate hierarchies, trust anchors, device authentication systems, externally managed certificates, and any certificates embedded in products or appliances.
Then identify systems with long upgrade cycles. Operational technology, security appliances, embedded devices, and specialized hardware are where you'll find your hardest constraints. If it takes a year to budget a replacement or if it requires a maintenance window you can only get quarterly, you need to know that now.
Build a non-production test environment where you can evaluate post-quantum certificate hierarchies safely. You're not trying to replicate your entire production environment; you're trying to test representative systems and workflows to find incompatibilities before they matter.
Is This Really a Multi-Year Effort?
It's multi-year because of your environment's complexity, not because the cryptography is incomplete.
The algorithms exist. Platform support is expanding. The hard part is the accumulated infrastructure you've deployed over decades: custom applications with fixed assumptions, devices you can't patch, vendors with their own timelines, and operational processes built around current certificate sizes and validation requirements.
Treat this as a program with owners, sequenced dependencies, and a roadmap that evolves as you learn more from testing. Use test results to prioritize modernization work. If you discover that your network inspection tools can't handle larger certificate chains, that goes on the roadmap. If your HSMs need firmware updates or replacement, that's a budget conversation you can have now instead of during a crisis.
Where Do I Go for Details on the Pilot Program?
Review the PQC TLS Pilot Program requirements and application process. The Microsoft Trusted Root Program Announcements page tracks which certificate authorities have joined and when new admissions occur.
If you're managing PKI infrastructure, consult your certificate provider about their participation status and what testing opportunities they offer. If they're not currently in the pilot but are part of the Microsoft Trusted Root Program, encourage them to participate through the admissions process.
The transition to post-quantum authentication won't happen in a single migration event. Organizations that start testing trust infrastructure and certificate dependencies now reduce future migration risk and build readiness before requirements force hasty decisions.
