#KEYMASTER: Introducing Unsigned X.509 Certificates for a Simpler Root of Trust

In this episode, Sven Rajala, International PKI Man of Mystery, is joined by David Hook, VP of Software Engineering for Bouncy Castle, to explore a surprisingly elegant change coming to X.509 certificates: the concept of unsigned certificates.

David explains that for self-signed (root) certificates, the signature itself does not add value; it does not prove key provenance, since it is signed by the same key it certifies. With post-quantum cryptography introducing much larger signature sizes, this redundancy can become costly in both storage and processing.

The new standard introduces a “no signature” option: a defined empty signature field representing a trusted anchor without unnecessary data. The result is smaller certificates, more straightforward validation logic, and a more efficient foundation for future cryptographic systems.

Watch video on YouTube

Bouncy Castle already supports the draft specification, with full alignment to the finalized object identifier coming in the next release. The draft is expected to be formally published as a new RFC titled “Unsigned Trust Anchors” in January 2026, which will also act as an update to the existing RFC 5280 (Internet X.509 Public Key Infrastructure Certificate and CRL Profile).

Key Takeaways

• Simple but powerful idea: Remove redundant signatures from self-signed root certificates.
• Efficiency boost: Saves space and simplifies handling, especially important for post-quantum algorithms with large signatures.
• Trust model unchanged: Roots remain trust anchors, their authenticity is assumed, having never been proven by a self-signature.
• Already supported: Bouncy Castle has implemented the latest version in the 1.83-SNAPSHOT with backwards compatibility for earlier drafts, which is supported in the current release.
• Standard evolution: The concept will be published as “Unsigned Trust Anchors”, updating and extending RFC 5280 in early 2026.

Learn more

• Read the IETF draft: Unsigned X.509 Certificates