Cloudflare Plans Public Certificate Authority With Post-Quantum Certificates
Summary
Cloudflare plans to become a public certificate authority, has applied to major root programs, and agreed to acquire a trusted GlobalSign root. It plans to issue Merkle Tree Certificates in early 2027 but is not issuing certificates yet.
Key points
- Cloudflare says it has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and signed an agreement to acquire an established GlobalSign root.
- The company is not issuing certificates yet; it says approval processes are ongoing.
- Cloudflare plans to offer automated issuance and renewal through ACME.
- The planned CA will require subscribers to support ACME Renewal Information (ARI) and automate certificate renewal.
- Cloudflare says it will publish reproducible signing-software builds, attest the hardware security modules holding its keys, and operate a public issuance-health and incidents dashboard.
- The company plans to issue production Merkle Tree Certificates in early 2027, describing them as a more compact certificate format designed for post-quantum authentication.
Article Details
- Event Type
- Cloudflare announced its intent to become a public certificate authority, applied for inclusion in four root programs, and signed an agreement to acquire a trusted root from GlobalSign.
- Impact
- Cloudflare says the planned CA is intended to add another free, automated certificate provider, improve redundancy across the certificate supply chain, and support both traditional certificates and post-quantum Merkle Tree Certificates. Cloudflare is not issuing certificates yet; it plans to issue its first Merkle Tree Certificates in early 2027.
Vendors
Cloudflarenearly doubled the number of encrypted sites on the web overnight, giving free TLS to every site behind Cloudflare, including the ones that never paid us a cent. Encryption stopped being an expensive, time-intensiveGlobalSignand we have signed a definitive agreement to acquire an established, broadly trusted root from GlobalSign, so that we can offer certificates with the widest possible device reach the day we begin issuing.Let's Encryptmodel now carries most of the encrypted web, and much of it runs through one remarkable operator. Let's Encrypt issues on the order of ten million certificates a day, serves more than 500 million sites, and passed