Thought Leadership
Cloudflare is becoming a public CA, acquiring root key material from Globalsign for this purpose. The new certificate authority is also set to issue post-quantum certificates based on Merkle trees.
Cloudflare is entering the TLS certificate business. As the company announced, it intends to build a public Certificate Authority (CA). In addition to traditional certificates, it plans to issue so-called Merkle Tree Certificates (MTCs), which are designed for the era following the breakthrough of quantum computers.
To ensure that the certificates do not take years to work across all devices, Cloudflare is purchasing established key material from a publicly trusted root CA from Globalsign. The root certificate is already embedded in many browsers and operating systems. As a result, certificates issued by Cloudflare will be immediately accepted even on older smartphones and devices without software updates. The acquisition is expected to close within the next two months, subject to customary conditions.
In parallel, Cloudflare has applied through regular channels for the root programs of Chrome, Apple, Microsoft, and Mozilla. The company plans to begin issuing traditional certificates once this onboarding process is complete. Cloudflare has not named a specific date for this.
Post-Quantum Signatures Are Too Large for the Handshake
The more interesting part of the announcement concerns the MTCs. Post-quantum signature schemes face a practical problem: Their signatures and keys are many times larger than today’s standard algorithms based on RSA or elliptic curves. Incorporating them one-to-one into the existing certificate chain would not remain without consequences for connection setup latency.
Merkle Tree Certificates address this issue. Instead of transmitting multiple large signatures with every connection, a compact proof demonstrates that a certificate is recorded in a trusted, publicly viewable log. The transparency that is created today via separate Certificate Transparency logs is thus built directly into the process. Cloudflare is a co-author of the corresponding IETF draft specification and has already tested the process in an experiment with Google Chrome. Production MTCs are scheduled to be issued in the first quarter of 2027.
Website operators are expected to be able to manage traditional certificates and MTCs in a shared system; an immediate transition is not required.
Transparency and Automatic Certificate Replacement
Cloudflare also promises greater insight into operations than is customary with traditional CAs. Alongside required audits, reproducible code builds are to be published and a public live dashboard showing the status of the CA will be provided.
In the event of mass revocations, the company relies on RFC 9773, better known as ACME Renewal Information (ARI). Through this, a CA can signal to clients that they should renew their certificates early. Cloudflare aims to be able to swap certificates on millions of websites in the background without causing outages. In the past, short-notice revocations at other CAs repeatedly caused issues for operators.
Against Concentration, but a Heavyweight Itself
Cloudflare cites market concentration as one of the reasons for the move: Trust on the web depends on a few dominant providers, which represents a systemic risk. The vast majority of encrypted websites today use free, automatically issued certificates, a large portion of which originate from Let’s Encrypt.
The argument is not without irony, as Cloudflare itself is one of the largest infrastructure providers on the web. Until now, the company has sourced certificates for its customers from external CAs. In the future, with proxy, CDN, and certificate issuance, it would control yet another part of the chain of trust itself.
Cloudflare CEO Matthew Prince referenced the introduction of Universal SSL in 2014, with which the company provided free TLS certificates for millions of websites. He described securing the web for the quantum era as one of the largest coordination tasks in the history of the internet.
(Editorial Team)
