Documenting how to use OpenSSL::SSL::SSLContext in PQC use cases #1118

Activity

1. rhenium commented on Oct 2, 2026

   

   rhenium

   on Oct 2, 2026

   Member

   More actions

   The class/module-level docs are getting outdated. I'd be very helpful if you could work on this!

   BTW using multiple certificates (calling SSLContext#add_certificate multiple times) is a very niche use case, so I'm not so sure if it warrants a dedicated section.
2. neverpanic commented on Oct 5, 2026

   

   neverpanic

   on Oct 5, 2026

   More actions

   BTW using multiple certificates (calling SSLContext#add_certificate multiple times) is a very niche use case, so I'm not so sure if it warrants a dedicated section.

   I believe this will become more common in the future. Both Google's Chrome root CA program and Apple's root CA program have announced they will support Merkle Tree Certificates, and both Cloudflare and Letsencrypt will soon run trials to issue Merkle Tree Certificates using ACME and plan to deploy those around 2027/2028.

   Many users that want to opt-in to post-quantum security with their server certificates without cutting off older clients that don't support them yet will use this, so I think this will move from a niche use case to a much more common one over the next 2-3 years.
3. junaruga commented on Oct 5, 2026

   

   junaruga

   on Oct 5, 2026

   Last edited by junaruga

   MemberAuthor

   More actions

   @rhenium OK. I will work on this, and will send a PR.

   I talked with OpenSSL team at my company, showing this issue ticket link. And @neverpanic helped me. For the Merkle Tree Certificates (MTC) that neverpanic mentioned, this is what I wrote a little on the Ruby ticket bellow.

   https://bugs.ruby-lang.org/issues/22068#Standardization-status-for-PQC

   But the future of ML-DSA is Merkle Tree Certificate (MTC)-based or public-CA. MTC is a kind of alternative of public-CA.

   In my understanding, MTC is alternative of public CA, and being invented to use PQC signature algorithms such as ML-DSA and SLH-DSA. According to the Google Chrome's community to promote MTC, the existing public CA is not practical with the PQC signature algorithms that has much larger sized signatures than the current non-PQC signatures. So, supporting MTC means

   https://googlechrome.github.io/chromerootprogram/crp/moving-forward-together/

   Unfortunately, post-quantum keys and signatures have a fundamental problem: their size. A single post-quantum signature can be over 20 times larger than the classical cryptography signatures commonly used today (e.g., ECDSA). Considering that secure connections in Chrome often rely on more than 5 signatures and 2 public keys, attempting to use post-quantum cryptography as a "drop-in" replacement within the existing ecosystem would drastically degrade internet performance. For this reason Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store and will only do so as a last resort.

   Instead, Chrome, in collaboration with other partners, is exploring a fundamental evolution of the ecosystem based on Merkle Tree Certificates (MTCs). MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs. In this model, a CA signs a single "Tree Head" representing potentially millions of certificates, and the "certificate" sent to the browser is merely a lightweight proof of inclusion in that tree.

   For the following neverpanic's comment, maybe I found the following primary source references of their articles to support MTC.

   Both Google's Chrome root CA program and Apple's root CA program have announced they will support Merkle Tree Certificates, and both Cloudflare and Letsencrypt will soon run trials to issue Merkle Tree Certificates using ACME and plan to deploy those around 2027/2028.

   • Google: https://blog.google/security/cultivating-a-robust-and-efficient-quantum-safe-https/
   • Apple: https://groups.google.com/a/chromium.org/g/ct-policy/c/QGZw2ADMXvk/m/pR3A5uRZCAAJ . This is a kind of official announcement, maybe?
   • Claudflare: https://blog.cloudflare.com/bootstrap-mtc/
   • Letsencrypt: https://letsencrypt.org/2026/06/03/pq-certs
4. junaruga commented on Oct 5, 2026

   

   junaruga

   on Oct 5, 2026

   MemberAuthor

   More actions

   Claudeflare offers RSA (non-PQC) and ECDSA (non-PQC) certificates. This is not the PQC and non-PQC. But this is the case that a vendor offers multiple certificate hosting TLS server, isn't it?

   https://developers.cloudflare.com/ssl/faq/#does-cloudflare-issue-both-rsa-and-ecdsa-certificates

   Q. Does Cloudflare issue both RSA and ECDSA certificates?
   A. Yes. Cloudflare can issue both RSA and ECDSA certificates.
5. junaruga commented on Oct 6, 2026

   

   junaruga

   on Oct 6, 2026

   Last edited by junaruga

   MemberAuthor

   More actions

   Here is another clue that PQC/non-PQC signatures use case will be common in my opinion. OpenSSH 10.6 added the following PQC/non-PQC hybrid sh-mldsa44-ed25519 (ML-DSA-44 + ED25519) signature algorithm. This is not multiple signatures, but maybe OpenSSL-specific one hybrid signature algorithm which is like ML-KEM's hybrid key exchange algorithm X25519MLKEM768 (X25519 + MLKEM768). But I think this shows PQC/non-PQC multiple signatures use case will be common.

   https://www.openssh.org/txt/release-10.6

   • All: enable hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm.

   Below is maybe the initial commit implementing the ssh-mldsa44-ed25519 feature. The commit message is useful to understand what this feature is. It seems that the ssh-mldsa-eddsa.c is the main file.

   openssh/openssh-portable@81ca145

   Below are the sshd_config (SSH server config) and ssh_config (SSH client config) manual documents. It seems that they added ssh-mldsa44-ed25519 in CASignatureAlgorithms config item in both SSH server and client config files.

   sshd_config(5)
   https://github.com/openssh/openssh-portable/blob/V_10_6/sshd_config.5#L411-L421

   ssh_config(5)
   https://github.com/openssh/openssh-portable/blob/V_10_6/ssh_config.5#L470-L480
6. junaruga commented on Oct 26, 2026

   

   junaruga

   on Oct 26, 2026

   MemberAuthor

   More actions

   I sent the PR #1131 to fix this issue.