What the source confirms
According to Microsoft, the company launched the PQC TLS Pilot Program on August 27, 2026. The pilot lets approved certificate authorities (CAs) in good standing with the Microsoft Trusted Root Program evaluate PQC TLS roots and certificate issuance based on the ML-DSA-87 algorithm 1. The August release added seven pilot roots. Their operators are ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority and SSL.com. Admission of new participants will continue on a rolling basis through the end of 2026 1.
Support for ML-DSA certificates in Windows 11 begins with the July 28, 2026 updates: KB5101681 for 26H1 and KB5101684 for 25H2. In supported scenarios, these certificates also work with Schannel. Microsoft advises confirming the platform requirements before testing 1.
Important limitations
The pilot certificates are not publicly trusted. They are intended only for compatibility testing in closed environments, custom applications and enterprise testbeds. They must not be used for production trust scenarios or on public-facing websites 1. Microsoft also warns that ML-DSA support during the pilot is limited, still evolving and not suitable for production use 1.
How authentication differs from encryption
Discussion of PQC usually centres on confidentiality and the "harvest now, decrypt later" risk. According to Microsoft, authentication brings a different set of challenges: it depends on a whole ecosystem of technologies and trust relationships. Certificates and keys must be issued, distributed, stored, validated and renewed across different environments and vendors 1. The source notes that organizations often understand where TLS protects their communications, but fewer organizations have a complete inventory of all systems that depend on certificates 1. Larger post-quantum certificates and chains may affect handshake size, performance, storage, transmission and traffic inspection limits 1. Among the potentially affected components, the source lists embedded devices, OT, security appliances, custom applications, third-party services and hardware security modules (HSMs) 1.
Interpretation
This is the vendor's position, not an independent assessment. Microsoft argues that the problem is not a lack of standards, but how new certificate hierarchies interact with systems already deployed 1. In our view, the logic is reasonable: the pilot by itself does not solve the migration problem, but it can serve as a safe venue for uncovering hidden dependencies before they affect the production environment. The supplied material does not specify a timeline for a mass transition.
What you can do now
Microsoft recommends [^1]:
- Inventory systems that depend on certificates.
- Map trust relationships — public and private PKI, trust anchors, device authentication.
- Ask vendors of certificates, PKI, HSMs and software about their post-quantum plans.
- Identify long-lived infrastructure with long upgrade cycles.
- Set up a non-production testbed to check compatibility and performance.
- Build a multi-year roadmap with assigned owners.
It is also worth asking your certificate provider whether it participates in the pilot 1.
Open questions
The supplied material does not make clear when ML-DSA certificates will become publicly trusted. It is unknown how much larger chains will affect specific networks and which devices will need replacement rather than an update. Testing can help organizations gather data for their own assessment, but it does not guarantee ready answers.