ML-DSA Certificates Use X.509, But Aren't Yet For Public TLS. - Quantum Zeitgeist

The technical groundwork for a quantum-resistant internet is further along than the policy needed to build it. The IETF finalized the standard for encoding ML-DSA signatures within X.509 certificates in RFC 9881 in October 2025, yet as of this year the CA/Browser Forum has not approved their use in publicly trusted TLS certificates. This creates a clear timeline; organizations can begin building post-quantum certificate authorities now, but widespread adoption for secure browsing remains a future goal. Encryption, facing the immediate threat of “store now, decrypt later” attacks, prioritized key exchange solutions before signature updates.

This discrepancy highlights a growing gap between the readiness of post-quantum cryptographic algorithms and the policy frameworks needed for their widespread deployment, a situation that could delay the transition to a quantum-resistant internet. NIST’s finalized standards, FIPS 204 for ML-DSA and FIPS 205 for SLH-DSA, published on August 13, 2024, define distinct approaches to quantum-resistant cryptography, each with its own performance characteristics and ideal use cases.