Cloudflare announced on 29 September 2026 that it intends to become a public certificate authority, with plans to issue both conventional publicly trusted TLS certificates and post-quantum Merkle Tree Certificates. The company has applied to the Chrome, Apple, Microsoft and Mozilla root programmes and has signed an agreement to acquire an established GlobalSign root so that it can reach older devices as well as newer trust stores.
What Cloudflare is actually changing
Cloudflare has spent more than a decade consuming certificates from public certificate authorities for its own network and for customers using Universal SSL. The new plan changes that relationship: Cloudflare wants to become an issuer itself.
The company says it has started the process of applying for inclusion in the major browser and operating-system root programmes. It has also signed a definitive agreement to acquire an existing GlobalSign root that has broad trust coverage dating back to 2012. That gives Cloudflare a route to support older clients while it works through the slower process of establishing newer roots under current programme rules.
This does not mean Cloudflare is issuing public certificates today. The announcement describes an infrastructure and trust-building programme that still has to pass root-programme, operational and compliance requirements before broad issuance begins.
Why a Cloudflare certificate authority matters
For website owners, the practical effect could eventually be a simpler certificate lifecycle. Cloudflare already manages DNS, CDN, reverse proxying, TLS termination and application security for many sites. Becoming a CA would allow certificate issuance and delivery to sit inside the same operational stack.
That could reduce hand-offs between separate providers, especially for organisations that already depend heavily on Cloudflare. It may also make certificate rotation easier to automate because the same platform can observe the edge configuration, control issuance and coordinate replacement.
The trade-off is concentration. Combining DNS, traffic management, security and certificate issuance under one vendor can reduce operational friction, but it also increases dependency on that vendor’s availability, policy decisions and account controls. Businesses should treat convenience and concentration as separate considerations.
The post-quantum part is more important than it looks
Cloudflare is also positioning the new CA around Merkle Tree Certificates, or MTCs. These are designed to make post-quantum authentication practical at Internet scale without creating oversized certificate chains and slower TLS handshakes.
Instead of signing every certificate individually with a large post-quantum signature, MTCs organise certificates in an append-only Merkle tree. The CA signs a tree head, and a client verifies that a certificate is included by checking a compact proof against that signed tree state.
Cloudflare describes this as a way to combine certificate issuance and transparency more tightly. The design shifts from the traditional model of issuing a certificate and then separately logging it, towards a model where issuance itself is tied to the transparency structure.
Chrome is already working on the same direction
This is not a Cloudflare-only experiment. Chromium’s 2026 security updates describe Merkle Tree Certificates as an integrated issuance and transparency system for size-efficient quantum-resistant HTTPS certificates. Chrome has already been working with Cloudflare on experimental deployment and has identified MTCs as part of its broader post-quantum certificate work.
That matters because certificate technology only becomes useful when browsers, certificate authorities, operating systems and standards bodies move together. A technically sound certificate format has little value if mainstream clients cannot validate it.
Cloudflare says it is targeting early 2027 for inclusion in Chrome’s new quantum-resistant root programme and the first production MTC issuance. That timeline should be treated as a target, not a guarantee, because trust-store inclusion and standards work depend on external review as well as Cloudflare’s own engineering.
What site owners should do now
There is no immediate migration task for ordinary site owners. Existing TLS certificates remain valid, and Cloudflare’s announcement does not require businesses to change certificate providers today.
- Keep certificate renewal automated: ACME-based renewal and short-lived certificates remain strong operational practices regardless of which CA issues them.
- Track provider support: if you use Cloudflare heavily, watch when its own CA becomes available and which certificate types are offered first.
- Review vendor concentration: decide whether combining more trust functions under one provider improves resilience or creates a single point of operational dependency.
- Include post-quantum readiness in procurement: when evaluating new infrastructure or security services, ask how the vendor plans to support post-quantum encryption and authentication.
- Avoid premature redesign: MTC support is still emerging, so do not rebuild production TLS architecture around features that browsers and CAs are still standardising.
What developers should watch
Developers should pay attention to how tooling changes around certificate automation. Chrome’s root policy increasingly emphasises automated issuance, and Cloudflare says its CA will support both classical certificates and newer post-quantum mechanisms.
If the new CA follows through on the promised transparency and automation model, the biggest practical change may be less visible than the cryptography itself. Faster renewal, more transparent incident handling and tighter lifecycle integration could matter to developers long before most users notice a difference in browser behaviour.
It is also worth separating post-quantum encryption from post-quantum authentication. Many services already use hybrid post-quantum key exchange for protecting data in transit, while certificate authentication remains a harder ecosystem-wide transition. MTCs are aimed at that second problem.
Critical analysis
Cloudflare’s decision to become a public certificate authority is strategically significant because it moves the company deeper into the trust infrastructure of the web. The strongest argument for the move is operational: Cloudflare already sits in the path of a large amount of encrypted web traffic, so tighter certificate issuance and lifecycle management could reduce complexity for customers.
The post-quantum work is credible because it is not being developed in isolation. Chromium has publicly documented its work on MTCs and its collaboration with Cloudflare, which gives the proposal more weight than a vendor-specific certificate format would have.
The biggest uncertainty is execution. Root-store inclusion, GlobalSign root transfer, compliance, interoperability and production MTC issuance all require external approvals and ecosystem coordination. Businesses should therefore view the announcement as a direction of travel rather than a finished service.
The best response today is to keep certificate operations automated, avoid unnecessary manual renewal processes and watch how browser support develops. If Cloudflare delivers both classical and post-quantum issuance through one managed platform, the eventual benefit could be a smoother migration rather than a disruptive cutover.
Leave a Reply