Keep connections efficient.
Post-quantum signatures add data to certificate chains. MTCs aim to reduce that overhead so stronger authentication doesn’t mean carrying all those signatures on every connection.
MERKLE TREE CERTIFICATES
Digital trust is evolving.
Keep moving
with confidence.
Browsers need proof that they’re connecting to the right website. Quantum-resistant signatures make that proof much bigger. Merkle Tree Certificates (MTCs) offer a different way to deliver it. Here’s what that means for your website and the people who keep it running.
The standard is still taking shape. There’s useful work you can do now.
TRUST, REIMAGINEDMerkle tree
A short proof. A verifiable connection.Landmark-relative form · illustration
The log holds the history. Your server sends the proof.
Why it matters
Stronger trust.
Less friction for your business.
Keep services dependable.
Getting a new certificate from the issuer is only part of the job. It still needs to reach the right servers. Automate the request and installation, then check that each service is presenting the replacement.
Prepare without guesswork.
Your provider, browsers, and server software handle the MTC details. Focus on supported software and reliable automation.
MTCs, explained
One certificate entry.
Two ways to prove trust.
A public, tamper-evident log records the certificate. Two forms prove its inclusion; supporting software selects the appropriate form for the connection.
01 / StandaloneAvailable first
Trust that travels
with the certificate.
CertificateInclusion proofCA + cosigner signatures
The standalone form carries proof and signatures from the certificate authority (CA) and cosigners, the parties signing the log summary. An MTC-capable browser can use it before the relevant landmark data arrives, provided it trusts those parties.
The takeawayAvailable first, with more data to send.
02 / Landmark-relativeUsable later
Less to send.
More known in advance.
CertificateInclusion proofNo attached signatures
A landmark is a trusted summary of part of the log, delivered to browsers ahead of time. Once the browser has the right summary, your server can send a compact inclusion proof without attached CA or cosigner signatures.
The takeawaySmaller to send, once the browser has the right landmark data.
See the sequence.
Follow the certificate from issuance to use.Start with standalone
The website can use standalone while landmark data catches up.
The server sends the proof and required signatures together. The browser needs MTC support and trust in the issuer and cosigners, but it doesn’t need to have received the covering landmark yet.
You don’t need to check landmark coverage by hand. Ask your vendors how their software handles it. Older clients may still need traditional certificates. MTCs address one part of the connection: the server’s own TLS signature and post-quantum key exchange remain separate.
What you need to do
Prepare the workflow.
Let software handle the details.
Start with the services and automation you manage today. Work with your certificate provider and infrastructure vendors on MTC support.
Plan your preparation ↗01 · Automate the complete lifecycle
Connect issuance, retrieval, installation, renewal, and endpoint verification. Confirm ACME and early-replacement support with your provider. Include retries, alerts, and an owner for failures.
02 · Confirm software compatibility
Ask your CA, hosting/CDN, load balancer, and server vendors how their software will support both MTC forms and client-aware selection. You do not need to determine landmark coverage yourself.
03 · Test continuity before expanding
Pilot a representative service. Exercise automated renewal, early replacement, failure recovery, and compatibility with existing clients.
Why Sectigo
Your public CA.
Your automation platform.
A connected path forward.
Bring Sectigo-issued certificates and lifecycle management together. Reduce supplier handoffs and agree a clear path for support and escalation.
Explore SCM with an expert ↗See what needs attention.
SCM centralizes certificate discovery and inventory, giving your teams a starting point for preparation.
Connect issuance and automation.
Combine public CA services with SCM workflows for issuance, deployment, renewal, and replacement.
Keep accountability and flexibility.
Define ownership for Sectigo-issued certificates and SCM, with CA-agnostic management for your broader estate.
Readiness strategy, not a claim of generally available production MTC issuance or both-form orchestration in SCM. Confirm current support, integration coverage, and service commitments with Sectigo.
Illustrative annual workload
12,167renewal cycles / year
30 daysmodeled replacement interval
4,563hands-on hours / year
Your next step
Close the manual gaps.
Pilot end-to-end automation on a representative service, including deployment verification and recovery.
The interval is your chosen planning assumption.
Assumptions & calculation
Annual cycles = certificate count × 365 ÷ your planned renewal interval. Manual hours = cycles × manual share × minutes ÷ 60. Whole-number outputs are rounded. This steady-state planning model excludes validation work, incidents, deployment fan-out, and MTC proof updates; it is not a savings or performance guarantee. Replacing at maximum validity leaves no modeled recovery margin. Public TLS validity schedule ↗
KEEP EXPLORING
Build your MTC knowledge.
Your questions
A few essentials.
Do we need to manage landmark data ourselves?
No manual landmark management is intended for normal operation. The certificate provider, browser, and supporting software handle publication, distribution, trust, and certificate selection. Your task is to confirm support and automate a tested deployment workflow.
Do MTCs make the whole connection quantum-safe?
A certificate format alone is not enough. Algorithms, client and server implementations, and post-quantum key exchange also matter. MTCs address certificate authentication and logging overhead.
Do we need to replace everything now?
No. MTCs remain an evolving Internet-Draft. Improve inventory and automation now; plan adoption with your vendors as browser, CA, and infrastructure support becomes available.
Is ACME enough, or do we need CLM?
A well-managed ACME implementation may meet some needs. Evaluate CLM where you also need estate-wide discovery, governance, deployment coordination, monitoring, and recovery.
Take the next step
Make readiness practical.
Review your automation gaps, software dependencies,
and a pilot plan with Sectigo.