Cloudflare becomes a post-quantum certificate authority

Cloudflare becomes a post-quantum certificate authority

Twelve years after Universal SSL roughly doubled the amount of encrypted web traffic overnight, Cloudflare announced during this year's Birthday Week that it wants to run trust infrastructure instead of just renting it. The company intends to become a public certificate authority — the kind of organization that issues the TLS certificates websites rely on to prove their identity.

The announcement, published 2026-09-29, bundles three concrete milestones rather than a vague roadmap: an application to the Chrome, Apple, Microsoft, and Mozilla root programs, a signed agreement to acquire GlobalSign's publicly trusted root key material, and a plan to be one of the first CAs issuing Merkle Tree Certificates (MTCs), a post-quantum certificate design Cloudflare has been pushing at the IETF. Production MTC issuance is targeted for the first quarter of 2027.

None of this is live yet — Cloudflare is explicit that it isn't issuing certificates today. But the shape of the effort tells you where Web PKI is heading, and it's worth understanding before the first MTC shows up in your TLS handshakes.

Why the web needs another CA

Most of the encrypted web runs on free, automated certificates, and a striking share of that flows through one operator: Let's Encrypt issues on the order of ten million certificates a day and serves more than 500 million sites. Cloudflare — one of Let's Encrypt's biggest users — calls that concentration a systemic risk: if the dominant free CA had a bad week, there would be no comparable free, automated alternative ready to absorb the load.

Cloudflare has been building this redundancy privately for years: every Universal SSL certificate pack already ships a backup certificate from a different authority, ready to auto-deploy if the primary is revoked. A public CA is that same idea expanded to Internet scale.

There's also a second problem the CA announcement is designed to solve: most certificate infrastructure predates practical quantum computing. Post-quantum signatures are roughly 40 times larger than classical ones, and Cloudflare estimates they would balloon certificate transparency log storage by the same order of magnitude. The IETF PLANTS working group's answer — Merkle Tree Certificates — bakes transparency in as a first-party property instead of bolting it on afterward. The slogan says it all: don't log what you issue — issue by logging.

Two paths to trust, starting with someone else's root

A brand-new root is useless for years: it must propagate into browsers, operating systems, and devices, and it never reaches the long tail of hardware that stopped receiving updates long ago. That tail is where a lot of the world's traffic actually originates.

So Cloudflare is buying reach on day one. The agreement with GlobalSign hands Cloudflare an established root that has been trusted across browsers, OSes, and devices since 2012, and the deal is expected to close within the next two months. Alongside it, Cloudflare will submit a brand-new root to the root programs — one designed for the modern rules, since some programs now cap how old a trusted root may be. Old root for today's devices, new root for tomorrow's policies.

For site owners, the migration lever is deliberately boring: the CA is ACME-first. If you automate issuance today, switching to Cloudflare means changing a directory URL:

# Your ACME client keeps working as-is; only the CA endpoint changes.
certbot certonly --standalone \
  --server https://<cloudflare-ca>/acme/directory \
  --email [email protected] \
  -d hejes.my -d www.hejes.my

Automated renewal is also a requirement, not a suggestion: Cloudflare says it will make renewal automation a condition of issuance via ACME Renewal Information (ARI, RFC 9773). That's what lets a CA pull certificates and reissue across millions of sites without triggering a mass outage — when a cert needs retiring, the renewal window moves forward for exactly the affected batch.

Merkle Tree Certificates: proof, not a heavy signature

Here's the part that actually changes the protocol. A classical certificate chains multiple CA signatures up to a trust anchor; MTCs instead batch many certificates into an append-only Merkle tree and sign only the tree's root. A client verifies a server's certificate with a compact inclusion proof — a sequence of hashes — against that cosigned tree head, instead of validating pile after pile of post-quantum signatures on every connection.

The flow for a standalone MTC looks roughly like this:

Site  →  ACME  →  CA validates domain control
                        │
                        ▼
              append entry to CA issuance log
                        │
                        ▼
              CA signs fresh tree head (checkpoint)
                        │  cosigner mirrors the log, verifies
                        │  append-only consistency, adds cosignature
                        ▼
Site  ◄  MTC = public key + inclusion proof + cosignatures

Two forms exist. A standalone MTC carries the cosigned tree head and inclusion proof in its signature value — heavier, but self-contained. A landmark-relative MTC strips out the heavyweight post-quantum signatures entirely: the browser gets the trusted subtrees out-of-band (e.g., via a browser update), and the handshake transmits just one public key, one signature, and an inclusion proof under 1 kB.

Cloudflare already ran a pointed experiment with Chrome using a bootstrap CA: it served billions of MTCs to 50% of Chrome Beta 146 users and measured landmark MTCs about 9% faster at the median than a classical chain — though Cloudflare is upfront that most of that gain comes from eliding intermediate certificates, not the post-quantum math itself. The experiment wound down in August 2026.

Chrome runs its own Quantum-resistant Root Program, and Cloudflare's draft policy understanding is that MTC CAs need at least two cosignatures — one from the issuing CA and one from an independent, recognized mirroring cosigner. Cloudflare plans to implement its mirroring cosigner in Azul, its open-source Rust transparency log, speaking the c2sp tlog-mirror protocol, and it targets Chrome's Quantum-resistant Root Store inclusion "early 2027" (Google's own rollout phases the onboarding requirements later, so treat that timeline as Cloudflare's ambition, not Chrome's commitment).

Its ACME stack will be a fork of Boulder, the software that already powers Let's Encrypt, and Cloudflare says it will keep folding upstream changes back.

What stays and what changes

Classic certificates aren't going away overnight. Cloudflare is deliberately building one CA that carries both classic certs and MTCs under a single lifecycle, and expects MTCs to take a steadily growing share of issuance across a multi-decade window — no hard cutover, no requirement to run two systems. Standard MTC issuance will be free.

The more immediate shifts are operational. This CA is being designed backwards from the failures Cloudflare has watched Web PKI endure from the consuming side: rate limits, validation edge cases, revocation latency, and root distribution lag. The commitments on the table are unusually concrete — publish reproducible builds of the signing stack, attest the HSMs that hold the keys, run a live public health dashboard, and make transparency about everyday operation (not just annual audits) the default. Cloudflare will also be its own "Customer Zero," eating its own dog food across the millions of certificates a year it consumes.

Matthew Prince, Cloudflare's CEO, framed it as a coordination problem: "Upgrading the web's security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet." That's the honest version of the pitch. The TLS on your site, like the dead CDN domains trust infrastructure quietly relies on, only works because an ecosystem of mostly-invisible authorities behaves itself. Cloudflare's bet is that the way to secure the post-quantum web is to make that ecosystem's single points of failure go away — which is why one of the largest certificate consumers on the planet is now trying to become an issuer.

Sources

• Cloudflare Blog: Building a certificate authority for the whole Internet
• Cloudflare Blog: Building a post-quantum certificate authority with Merkle Tree Certificates
• Dark Reading (press release): Cloudflare Announces Public Certificate Authority for the Post-Quantum Web