QCERT
The project

Why QCERT

A quantum-resilient certificate infrastructure for Europe’s digital trust services.

Public key infrastructures underpin almost every trusted interaction online, from qualified electronic signatures and digital identity wallets to the padlock in your browser. The classical algorithms they rely on are expected to be broken by sufficiently powerful quantum computers, and data encrypted or signed today can be harvested now and attacked later.

QCERT designs and deploys a next-generation, quantum-resilient certificate infrastructure for Europe. It integrates post-quantum cryptography aligned with NIST and ETSI standards into existing trust and identity services, so that organisations can migrate step by step without breaking what already works.

What QCERT will deliver
  • Hybrid certificates combining classical and post-quantum algorithms
  • Merkle-tree-based certificates for scalable, verifiable trust chains
  • PQC-aware TLS and certificate-management protocols
  • Migration roadmaps for finance, government and digital identity
  • Alignment with eIDAS 2.0, NIS2 and the EU Cybersecurity Act
Approach

Technical building blocks, tested in real pilots

Each building block is developed as open, interoperable tooling and validated with trust service providers, certification authorities and critical-sector users.

WP2

Hybrid CA Toolkit

Dual-mode certificate issuance so authorities can sign with classical and post-quantum algorithms side by side.

WP3

Merkle Tree Certificates

Compact, verifiable certificate encodings that keep post-quantum signatures practical at scale.

WP4

PQC-aware TLS

Extending TLS 1.3 handshakes with post-quantum key exchange and signatures, end to end.

WP5

Interoperability & migration

Converters, adapters and validation APIs that bridge legacy PKI and quantum-safe trust.

WP6

Pilots & evaluation

Deployment and validation of the QCERT framework in real-world sectoral pilots.

WP7

Standards & uptake

Contributions to IETF, ETSI and ISO/IEC, policy alignment, dissemination and exploitation.

Work plan

Seven work packages over 36 months

  • WP1Project management and coordinationLead: UNI LUM1–M36
  • WP2Hybrid Certificate Authority ToolkitLead: DPGM1–M18
  • WP3Merkle Tree Certificate EngineLead: ADACOMM6–M30
  • WP4PQC-Aware TLS Integration LayerLead: UBITECHM9–M30
  • WP5PKI Interoperability & Migration ToolkitLead: INFOCERTM12–M34
  • WP6Deployment, Validation and EvaluationLead: IMDEAM15–M36
  • WP7Standardisation, Dissemination and ExploitationLead: NCSAM1–M36