Merkle Tree Certificates Explained

The move toward post-quantum cryptography solves one problem and creates another. It protects encrypted traffic against future quantum computers, but the new signature algorithms are far larger than the ones in use today. Placing them inside ordinary SSL Certificates would make every secure connection heavier to set up.

Merkle Tree Certificates are an emerging proposal designed to fix exactly that. Rather than putting a large signature on every SSL Certificate, they let a Certificate Authority (CA) sign a whole batch at once, then prove that any single SSL Certificate belongs to that batch with a short chain of hashes.

The Problem Post-Quantum Signatures Create

The SSL Certificates in use today rely on signatures from algorithms such as RSA and Elliptic Curve Cryptography (ECC). These signatures are small, and a browser can verify a chain of SSL Certificates within a few thousand bytes. Post-quantum algorithms change that picture completely.

A standardized post-quantum signature such as ML-DSA produces a signature of a few thousand bytes and a public key of nearly two thousand more. That is more than fifty times the size of a compact Elliptic Curve Cryptography (ECC) signature. Every SSL Certificate that switched to it would carry that weight.

The cost does not stop at one signature. A single connection verifies several signatures at once, including those in the chain of SSL Certificates and the proof that each SSL Certificate was publicly logged. With post-quantum algorithms, a handshake can grow past ten thousand bytes, which is enough to slow or break a noticeable share of connections.

The size of a handshake matters because it must complete before any page loads. Learn About the SSL/TLS Handshake 🔗

Shorter SSL Certificate lifetimes make the problem worse. Maximum SSL Certificate validity is already falling to 200 days, with further cuts to 100 days and then 47 days by 2029. Shorter lifetimes mean more frequent issuance, so any extra handshake cost is paid far more often. Discover the Validity Period Changes 🔗

A Closer Look at Merkle Trees

The idea at the center of this proposal is an old and reliable one. A Merkle tree is a way of combining many pieces of data into a single fingerprint by hashing them together in pairs, level by level, until only one hash remains at the top.

That single hash at the top is called the root. It depends on every item beneath it, so changing any one item changes the root. This gives Merkle trees a useful property. You can prove that one item belongs in the tree by revealing only a short path of hashes, not the entire set.

Hashes are also the right tool for the quantum era. A good hash function is considered resistant to quantum attacks, gaining only a modest speed advantage rather than being broken outright. A structure built on hashing therefore stays strong even as older signature methods weaken. Learn About SHA-256 Hashing 🔗

The Mechanics of a Merkle Tree Certificate

Merkle Tree Certificates apply that property to SSL Certificate issuance. Instead of signing each SSL Certificate on its own, a Certificate Authority (CA) collects a large batch of them and builds a Merkle tree over the whole group.

The Certificate Authority (CA) then signs just the root of that tree. A single signature now stands behind every SSL Certificate in the batch, which could be many thousands at a time. The heavy post-quantum signature is created once, not once per SSL Certificate.

What travels in the handshake is no longer a full signature. It is a compact proof of inclusion, a short path of hashes showing that this particular SSL Certificate sits within the batch the Certificate Authority (CA) already signed. That proof is small and quantum-resistant.

For this to work, the browser must already hold the Certificate Authority's signed tree head. Browsers regularly fetch small updates in the background, and the tree head is provisioned the same way. When the browser is up to date, the large signatures never need to travel across the connection at all.

The savings are large. Google, which is driving much of this work for Chrome, has reported the authentication data in a handshake dropping from roughly 14,700 bytes to as little as 736 bytes. That is smaller than many of the SSL Certificate chains in use today.

Public logging is folded into the design as well. Certificate Transparency, which normally adds separate signed timestamps to each connection, is built into issuance here rather than added afterward. Those extra signatures leave the handshake too. Explore Certificate Transparency 🔗

None of this is free. Because each SSL Certificate must be logged and mirrored before browsers will trust it, issuance is no longer instant. The optimization also helps only browsers that keep their tree heads current, so a fallback to conventional SSL Certificates covers everything else.

Keeping both paths available is what makes a gradual and low-risk transition possible.

The Wider Benefits for the Web

The goal behind Merkle Tree Certificates is to make post-quantum security affordable enough to switch on everywhere. A naive move to large signatures would penalize every website and every visitor. This approach aims to remove that penalty, and in the best case it makes secure connections lighter than they are now.

It also tightens security in a quiet way. Public logging becomes part of issuance rather than a separate step, which removes a class of signatures that a future quantum computer might otherwise target. The trust model behind the web gets simpler and more resistant at the same time.

This work is still experimental. It is being developed as an open standard through the Internet Engineering Task Force, and browser vendors and infrastructure providers began small live trials during 2026. It is not something you can buy or configure yet, and the details may still change. Learn About Quantum-Safe Certificates 🔗

Preparing for the Post-Quantum Transition

For website owners, there is nothing to change today. Merkle Tree Certificates are not a product, and the current SSL Certificates you hold are unaffected. The useful response is to prepare for a period of faster change rather than to act on this one proposal.

Two habits will carry you through it. The first is automation. As SSL Certificate lifetimes shorten and formats change, managing them by hand becomes impractical, and automated management through the Automatic Certificate Management Environment (ACME) keeps pace without manual effort. Learn About the ACME Protocol 🔗

The second is visibility. You cannot manage SSL Certificates you have lost track of, so knowing where each one lives is the foundation of any smooth transition. Keeping watch over them is the owner's responsibility, whether through a dedicated monitoring service or an in-house process that tracks expiry and coverage.

The move to post-quantum security is coming, and Merkle Tree Certificates show how the web can absorb it without slowing down. The proposal is still taking shape, so the sensible course is to follow it as it matures rather than to act now.