tech · quantum risk
Is Certificate Transparency Quantum Proof? Network Security & PQC
Verdict
Certificate Transparency improves PKI accountability but is not a quantum-proof control. Logs and SCTs still rely on classical signatures today; CT complements—not substitutes—hybrid TLS and CA algorithm migration.
Overview
CT logs public certificate issuance so domain owners and researchers can detect unexpected certs. Browsers often require SCTs for trusted public TLS.
Quantum computers do not “bypass CT” in the harvest-now-decrypt-later sense the way classical key exchange does—but CT infrastructure itself uses classical crypto and does not encrypt your sessions.
Keep CT on for public web PKI hygiene while you migrate leaf and handshake algorithms.
Cryptographic profile
- Signatures: Log signatures and SCTs (typically classical today), Monitored CA issuance
- Hash: Merkle tree hashes for log integrity
- Public-key exposure: CT detects mis-issuance; it does not replace quantum-safe handshakes.
What breaks
- Assuming CT equals confidentiality or PQC
- Ignoring private enterprise CAs outside public CT
- CT log ecosystem crypto still classical for integrity
Mitigations
- Monitor CT for your domains
- Separate enterprise private PKI monitoring from public CT
- Continue hybrid TLS and cert algorithm plans
FAQ
Is CT quantum-proof?
CT is an audit system. Quantum safety of sessions depends on TLS/KEM choices, not log inclusion alone.
Do internal mTLS certs need CT?
Public CT is for public web trust; internal PKI needs its own inventory and monitoring.
Key concepts (technical dictionary)
Terms used on this page — open a definition: