The Sovereign Tech Fund is investing in Let’s Encrypt to prepare its certificate authority for post-quantum cryptography, focusing on the development of Boulder software and new Merkle Tree Certificate-related services. Let’s Encrypt currently issues ten million certificates daily and secures 64.3% of all websites, according to W3Techs, and this funding will allow the organization to transition this infrastructure to withstand future threats from quantum computing.
ISRG explains that certificates protect the web services people rely on every day online, and this investment aims to maintain secure connections as signature sizes increase with new NIST-standardized schemes. ISRG plans to make the enhanced service generally available in 2027.
Let’s Encrypt Transition to Post-Quantum Cryptography (PQC)
Let’s Encrypt is adopting a new certificate format, Merkle Tree Certificates, to prepare for the advent of quantum computers and the resulting vulnerabilities in current encryption methods. The Internet Security Research Group (ISRG) is transitioning from research into a fully available service, a process bolstered by investment focused on the underlying software and infrastructure. Boulder, the open-source program written in Go that powers Let’s Encrypt, will undergo significant development and improvement to facilitate this shift.
The need for this upgrade stems from the increasing size of signatures required by post-quantum cryptographic schemes; even the smaller standardized options create signatures over 30 times larger than those currently in use. Traditional HTTPS connections rely on multiple signatures and keys, and directly replacing them would significantly inflate connection data, potentially slowing or breaking connections.
Merkle Tree Certificates circumvent this issue by using a single signature, public key and a short proof, often resulting in smaller connection sizes than those seen with traditional methods. The Sovereign Tech Fund’s investment will specifically fund evaluation of the existing Let’s Encrypt infrastructure, alongside the creation of design documents and collaboration with browser vendors, other certificate authorities and cryptography developers at the Internet Engineering Task Force (IETF) to finalize Merkle Tree Certificates standards.
This work extends beyond software; ISRG will construct a Merkle Tree Certificate Authority, a publisher service, and a mirror service, all of which will be rigorously tested within the Let’s Encrypt staging environment. Through December 2027, the organization will synchronize data across data centers with automatic failover, ensuring resilience and reliability.
Preparing the system for production involves a thorough review against the Chrome Quantum-Resistant Root Program and the TLS Baseline Requirements, followed by the generation of post-quantum signing keys on new hardware security modules during an audited key ceremony, Let’s Encrypt says. The final stage focuses on accessibility, with ISRG committed to creating comprehensive documentation for ACME client authors and web server operators, and ultimately making Merkle Tree Certificates available to all subscribers. The organization anticipates general availability of the enhanced service in 2027, marking an important step towards a quantum-resistant web.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
