Merkle Tree Certificates (MTC)

Merkle Tree Certificates (MTC) are an emerging, IETF-draft certificate format that replaces a traditional signature-based X.509 certificate with a compact Merkle tree inclusion proof, designed to keep certificates small even when built on large post-quantum signature algorithms.

Merkle Tree Certificates are a proposed alternative to traditional X.509 certificates that use a Merkle tree structure instead of a per-certificate digital signature. This keeps certificate size manageable even with large post-quantum signature schemes, addressing a key barrier to deploying PQC algorithms like ML-DSA at internet scale.

Key Takeaways

• Post-quantum signature algorithms such as ML-DSA (FIPS 204) produce far larger signatures than RSA or ECDSA, which risks bloating TLS handshakes if used in traditional X.509 certificates.
• Merkle Tree Certificates replace a per-certificate signature with a compact inclusion proof into a periodically published Merkle tree, keeping certificate size small regardless of the underlying signature algorithm’s size.
• MTC is currently an IETF draft specification, not yet a finalized standard, and is being developed specifically to ease the internet’s transition to post-quantum cryptography.
• As of mid-2026, MTC adoption is an early-mover opportunity: only a small number of major CAs, including DigiCert and Sectigo, have published technical content on the format.
• MTC trades certificate size for a dependency on timely tree publication, meaning relying parties need reasonably fresh tree data to verify a certificate’s inclusion proof.

Why Do Post-Quantum Signatures Create a Certificate Size Problem?

Traditional certificates embed a single digital signature from the issuing CA, and RSA or ECDSA signatures are small, typically a few hundred bytes. Post-quantum signature schemes such as ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) produce signatures that can be many times larger. Multiply that across a full certificate chain in every TLS handshake, and the added size can meaningfully slow connection setup and increase bandwidth use at internet scale.

How Do Merkle Tree Certificates Solve This?

Instead of embedding a full signature in each certificate, an MTC-issuing CA periodically batches many certificates into a Merkle tree and publishes the tree’s root. Each certificate then carries only a compact inclusion proof, a short set of hash values proving it is a genuine leaf in that published tree, rather than a full signature. This keeps the certificate itself small, regardless of how large the underlying post-quantum signature algorithm’s individual signatures would otherwise be.

What Is the Current Status of the Merkle Tree Certificates Specification?

Aspect	Current status (mid-2026)
Specification body	IETF draft, not yet a finalized RFC
Primary motivation	Manage certificate size growth from post-quantum signature algorithms
CA adoption	Early; a small number of major CAs have published technical exploration, not production issuance
Relying-party support	Not yet built into mainstream browsers or TLS libraries

What Tradeoff Does Mtc Introduce Compared to Traditional Certificates?

MTC’s compact inclusion proof depends on the relying party having reasonably current data about the published Merkle tree; a certificate cannot be verified against a tree the client has no knowledge of. This introduces a freshness dependency that traditional, self-contained signed certificates do not have, and is one of the open engineering questions the IETF draft process is still working through.

How Encryption Consulting Helps

How Encryption Consulting HelpsPQC Advisory Services help organizations track emerging certificate formats like Merkle Tree Certificates alongside finalized standards such as ML-DSA and ML-KEM, while CertSecure Manager keeps you ready to adopt new certificate formats as they mature. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

Are Merkle Tree Certificates a finalized standard?

No. As of mid-2026, Merkle Tree Certificates exist as an IETF draft specification, not a finalized RFC, and are not yet supported in production by mainstream browsers or TLS libraries.

Why can’t post-quantum signatures just be used in normal X.509 certificates?

They can be, and some deployments do this today, but post-quantum signature algorithms like ML-DSA and SLH-DSA produce much larger signatures than RSA or ECDSA. Embedding them directly in every certificate in a chain can meaningfully increase TLS handshake size and setup time at internet scale.

What problem do Merkle Tree Certificates specifically solve?

They solve the certificate size growth caused by post-quantum signatures. Instead of embedding a full signature per certificate, MTC uses a compact inclusion proof into a periodically published Merkle tree, keeping certificates small regardless of the underlying signature algorithm’s size.

Should organizations start planning for Merkle Tree Certificates now?

It is reasonable to track the format as part of broader post-quantum readiness planning, but MTC is not yet ready for production adoption. Organizations should prioritize finalized standards like ML-KEM (FIPS 203) and ML-DSA (FIPS 204) first, while monitoring MTC’s IETF progress.

Stay Ahead of Emerging Post-Quantum Certificate Formats

Take the next step PQC Advisory Services help you track and plan for emerging formats like Merkle Tree Certificates alongside your broader post-quantum migration. Plan your PQC migration with Encryption Consulting.