Post-quantum readiness is not just a future cryptography swap: Microsoft says organisations should start testing how certificates, applications and trust systems work together now. Its guidance offers practical first steps and points to a controlled pilot, with a clear warning that its test certificates are not for production.
Watch Desk analysis
What happened
Microsoft’s guidance recommends inventorying certificate-dependent systems, mapping trust relationships, checking vendor readiness and identifying infrastructure with long upgrade cycles. It advises organisations to build non-production test environments and treat the work as a multi-year programme.
Microsoft says its PQC TLS Pilot Program lets approved certificate authorities test post-quantum roots and certificate issuance using ML-DSA-87. Certificates issued through the pilot are not publicly trusted and are intended for closed testing, not production trust or public-facing websites. The company says supported, appropriately configured Windows 11 systems can evaluate ML-DSA certificates in controlled scenarios.
What to do now
- Inventory certificate dependencies
Find the applications, devices, services and infrastructure that issue, store, validate or rely on certificates. - Map trust and suppliers
Document public and private PKI relationships, then ask certificate, hardware and software vendors about their post-quantum plans. - Test away from production
Use a non-production environment to check compatibility, certificate sizes, performance and operational workflows. - Plan for long-lived systems
Give early attention to embedded devices, operational technology and other infrastructure with lengthy upgrade cycles.
Why it matters
A new algorithm can be sound on paper and still meet an awkward reality: old applications, large certificate chains, hardware limits and tangled trust relationships. Testing those pieces together can reveal migration work before a change becomes urgent.
The pilot gives eligible certificate authorities a controlled place to explore interoperability. It does not make its certificates suitable for production, and Microsoft says support remains limited and evolving.
Our read
The useful message is refreshingly concrete: find what depends on certificates, ask suppliers hard questions, then test safely. That is better than waiting for a deadline to discover that some forgotten appliance has opinions about certificate size.
Start with an inventory and a non-production test plan. Treat the pilot as a way to learn, not as a production-ready shortcut.
What to watch
- Whether more eligible certificate authorities join the pilot.
- What compatibility and performance problems emerge in testing.
- How Windows and vendor support develops before organisations plan production changes.
Discussion spark: Should organisations begin post-quantum certificate testing now, even when standards and vendor support are still evolving, or wait for a clearer migration timetable?
Sources and evidence
- Post-quantum authentication: Why organizations should start testing certificate ecosystems now – Microsoft (8 October 2026, 20:44 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.