Post-quantum security: why small businesses should review digital certificates now

What is changing?

Post-quantum cryptography means security methods designed to withstand attacks from future quantum computers. Much of the discussion concerns keeping encrypted information private. Microsoft’s article draws attention to another requirement: authentication, or checking that a system or service is who it claims to be.

Digital certificates help establish that trust. They depend on a network of certificate providers, software, devices and management processes. Moving to quantum-resistant methods therefore involves more than replacing one security setting.

Microsoft reports that it launched its Post-Quantum Cryptography TLS Pilot Program on 27 August 2026. It allows approved certificate authorities within the Microsoft Trusted Root Program to test quantum-resistant certificates in controlled environments. Certain supported and correctly configured Windows 11 systems can also take part in testing.

Why this matters to a smaller business

Even if your business does not run its own certificate infrastructure, applications, third-party services and security equipment may depend on certificates. Understanding those connections is an important starting point.

New certificate formats and larger certificate chains—the linked credentials used to establish trust—could expose compatibility problems. Applications may struggle to process them, equipment may encounter size limits, or connections may perform differently. The processes used to issue, store and renew certificates may also need updating.

Equipment with a long working life deserves particular attention. Embedded devices, security appliances and custom applications can have constraints that are difficult to spot until testing starts. Discovering these early gives businesses better information for planning upgrades.

Microsoft presents this as a multi-year preparation effort. Its message is to understand dependencies and test how systems work together, rather than assume a future software update will resolve every issue.

What the pilot does—and does not—offer

The pilot is aimed at eligible certificate authorities, rather than being a general rollout for business customers. It gives participants a way to investigate compatibility, performance and certificate-management processes before wider adoption.

Crucially, its certificates are not publicly trusted. They are restricted to closed testing environments and must not be used on public-facing websites or to establish trust in live business systems. Support for the pilot’s quantum-resistant signature method, ML-DSA, is still limited and developing.

Businesses interested in testing should speak to their certificate provider about participation and suitable opportunities. Any Windows-based testing also needs the relevant platform requirements checked first.

What to do next

Start with an inventory. Ask your IT team or managed IT provider to identify the applications, services, devices and security equipment that rely on certificates. Record who supplies and manages them, including externally managed certificates and any internal certificate systems.

Next, ask suppliers about their post-quantum plans. Include software vendors, certificate providers and relevant hardware suppliers. Find out what they support, what remains under development and whether they offer safe testing options.

Identify systems that are difficult to replace or have lengthy upgrade cycles. Use that information to decide where compatibility testing will be most useful, rather than treating every device as an identical priority.

Finally, create a non-production testing plan and assign responsibility for a longer-term transition roadmap. Test results should guide the order of future changes, keeping experimental certificates separate from everyday business operations.