Chrome begins testing Merkle Tree Certificates for quantum-safe HTTPS rollout

Chrome is addressing the challenge of integrating post-quantum cryptography into HTTPS without sacrificing performance. Traditional X.509 certificates, when paired with quantum-resistant algorithms, introduce significant bandwidth overhead due to larger key sizes. Merkle Tree Certificates (MTCs) offer a solution by replacing serialized signature chains with compact proofs of inclusion in a Merkle tree. This reduces the data transmitted during TLS handshakes while maintaining security and transparency properties similar to Certificate Transparency (CT).

The adoption of MTCs is not immediate but follows a structured rollout plan. Phase 1 involves real-world testing with Cloudflare, where MTC-based connections are backed by traditional X.509 certificates as a fail-safe. This allows Chrome to measure performance and reliability without risking user security. Phase 2, planned for early 2027, will invite existing CT Log operators to participate, leveraging their infrastructure to bootstrap public MTCs. The final phase will introduce a dedicated Quantum-resistant Root Store, enabling sites to opt into quantum-resistant certificates exclusively.

For engineers, this transition introduces new considerations for certificate management and TLS performance. MTCs decouple cryptographic strength from data size, but their adoption requires updates to certificate authorities (CAs) and log operators. The phased rollout provides time to adapt, but teams must monitor developments in the PLANTS working group and Chrome’s Root Program requirements. Downgrade protections will allow gradual adoption, but sites relying solely on quantum-resistant certificates may face compatibility challenges during the transition period.

The broader implications extend beyond Chrome. The IETF’s PLANTS working group is standardizing MTCs, and other browsers or platforms may adopt similar approaches. Engineers should evaluate the impact on their systems, particularly for high-traffic or latency-sensitive applications. While MTCs aim to maintain performance, real-world testing will reveal edge cases or limitations, such as compatibility with legacy clients or middleware that expects traditional X.509 certificates.