Microsoft Tests Post-Quantum Cryptography With Certificate Authorities in Controlled Pilot

Transitioning to quantum-resistant cryptography requires more than validating individual algorithms in isolation. The shift from planning to actual deployment hinges on testing that bridges the gap between technical specifications and systems ready for production use. Microsoft is now enlisting certificate authorities in this effort, treating the transition as an operational challenge rooted in customer needs rather than cryptographic novelty.

According to Karina Sirota Goodley, senior security product manager at Microsoft, the company's approach starts with identifying genuine business problems and operational constraints. "At Microsoft, the goal isn't to create a cryptographically interesting solution and then search for a use case," she said. "It's to start with a real customer or business problem, understand the operational constraints and build something that works across platforms, protocols, CAs, devices and existing infrastructure. In the post-quantum transition, practical interoperability and measurable risk reduction matter more than being crypto cool."

Goodley discussed the initiative with Lakshmi Hanspal, chief trust officer at DigiCert Inc., during DigiCert's World Quantum Readiness Day event, which was broadcast on theCUBE, a livestreaming platform operated by SiliconANGLE Media.

Post-quantum interoperability moves into controlled testing

Microsoft's Trusted Root Program is operating a post-quantum cryptography pilot focused on Transport Layer Security in non-production environments outside public trust chains. Seven certificate authorities are participating in the program, with DigiCert among them.

The controlled environment allows participating certificate authorities to evaluate issuance procedures and compatibility with Microsoft's platform capabilities without affecting live systems. "Certificate authorities can test issuance and compatibility with the Microsoft platform capabilities in a controlled environment," Goodley explained. "That matters because no individual component can declare success. The whole chain has to work."

Microsoft incorporates vendor dependencies directly into its readiness strategy rather than deferring them. Early collaboration between vendors can surface compatibility issues and deployment obstacles that might otherwise emerge during migration. "Make PQC migration your problem before it becomes your customer's problem," Goodley stated. "Deliver crypto agility, transparency and standards-based interoperability by default. Customers shouldn't have to become cryptographers to prepare for the quantum era. If the industry removes complexity and aligns on interoperable implementations, we'll accelerate quantum readiness far faster than any company can achieve on their own."