Microsoft tests post-quantum TLS issuance with seven certificate authorities outside public trust

Anyone who keeps a certificate inventory has two columns that matter here: the thing that terminates TLS, and the certificate authority that issued its certificate. Microsoft's pilot works the second column against Windows. "Certificate authorities can test issuance and compatibility with the Microsoft platform capabilities in a controlled environment," said Karina Sirota Goodley, a senior security product manager at Microsoft ^[3][7]. "That matters because no individual component can declare success. The whole chain has to work," she said ^[4].

The pilot sits outside production and public trust scenarios ^[1]. A customer's machine will not accept a certificate issued inside it, and the person maintaining the inventory has nothing to deploy this quarter. The pilot is for the CAs and for Microsoft's platform team. The operator benefits later, if both sides find the incompatibilities first.

Seven CAs are participating and Goodley named DigiCert ^[2]. She did not name the other six ^[13]. The interview ran on theCUBE at DigiCert's own World Quantum Readiness Day, an event for which theCUBE is a paid media partner ^[8][9]. The account does not say which algorithms are under test, what counts as a pass, or when post-quantum certificates enter public trust ^[14].

The work described in this pilot is a supplier and a platform checking whether one can issue what the other will parse. Goodley put the ordering plainly. "At Microsoft, the goal isn't to create a cryptographically interesting solution and then search for a use case," she said. "It's to start with a real customer or business problem, understand the operational constraints and build something that works across platforms, protocols, CAs, devices and existing infrastructure. In the post-quantum transition, practical interoperability and measurable risk reduction matter more than being crypto cool" ^[5].

Microsoft counts vendor dependencies inside its readiness program instead of leaving them until later, and Goodley said early coordination can expose compatibility and deployment constraints ^[10]. Her instruction to suppliers was blunt: "Make PQC migration your problem before it becomes your customer's problem," she said ^[11].

The useful list for a team with a 2027 or 2028 migration date on a slide has two entries per row: who issues the certificate for this endpoint, and what validates it. Where the issuer has tested against the validator, the date can be defended. Where neither has, the date is a placeholder. The pilot is the reason it will stay one until the CA can say which side broke. "Customers shouldn't have to become cryptographers to prepare for the quantum era," Goodley said ^[12].