Let's Encrypt Adopts Merkle Tree Certificates for Post-Quantum Web PKI

Let's Encrypt said it will use Merkle Tree Certificates (MTCs) as its preferred approach for post-quantum authentication on the public web, arguing that conventional post-quantum signatures such as ML-DSA would make standard TLS certificate chains too large for reliable internet-scale handshakes. The model batches certificate issuance under a single signed Merkle tree head and delivers compact inclusion proofs, reducing handshake overhead while making Certificate Transparency inherent to issuance. Let’s Encrypt said current subscribers do not need to take immediate action, but future ACME clients and related tooling will need updates as the ecosystem moves toward the new format.

The move aligns Let’s Encrypt with broader work by Google, Cloudflare, Chrome, DigiCert, and the IETF, as browser and infrastructure vendors push for scalable post-quantum TLS ahead of government migration deadlines from the NSA, NIST, and the EU. Let’s Encrypt plans a staging environment for MTC issuance in late 2026 and a production-ready deployment in 2027, while continuing to track ML-DSA support for traditional X.509 use cases outside the browser ecosystem. It also said the more urgent near-term defense remains post-quantum encryption against harvest-now-decrypt-later threats, urging operators to enable hybrid key exchange such as:

X25519MLKEM768