Cloudflare seeks to become a certificate authority and issue post-quantum certificates in 2027

On 29 September Cloudflare announced that it wants to become a public certificate authority (CA): that is, to issue the certificates that browsers use to check that a website is who it claims to be. According to the company’s announcement, it has applied to join the root programmes of Chrome, Apple, Microsoft and Mozilla and has signed a definitive agreement to buy an already trusted root from GlobalSign. It does not yet issue any certificates.

For those preparing the migration to post-quantum cryptography (PQC), the relevant part of the announcement is another one: Cloudflare plans to issue its first Merkle Tree Certificates (MTCs), a certificate format designed for post-quantum signatures, in production in the first quarter of 2027.

Why Chrome is backing MTCs

Post-quantum signatures are much larger than current ones, and an X.509 certificate chain that uses them can make the start of every TLS connection heavier. In February, Chrome’s security team said it has no immediate plans to add traditional X.509 certificates with post-quantum cryptography to its root store. Its alternative is MTCs: the CA signs once the root of a Merkle tree that can represent millions of certificates, and what the browser receives is a lightweight proof that the certificate is in that tree. Because issuing a certificate means publishing it in the tree, transparency comes built in.

The format is not yet a standard. It is a draft from the IETF’s PLANTS working group, which published its version 07 on 7 October and whose authors are from Google, Apple, Cloudflare and Geomys.

What Cloudflare has announced

• Two roots. GlobalSign’s, trusted since 2012, to reach from day one older devices that a new root would never reach; and new roots to comply with the policies that are beginning to limit the age of trusted roots.
• Free, automated certificates. They will be requested only through ACME, the protocol already used by free CAs, and only by clients that support ACME Renewal Information (ARI), so that the CA can bring renewals forward if it has to revoke certificates.
• A single CA for both types. It will issue classical certificates and MTCs with the same life cycle, because it expects much of the Internet to keep using classical certificates for many years.
• Operational transparency. Reproducible builds of the signing software, attestation of the hardware security modules (HSMs) that hold the keys, and a public incident dashboard.

The company justifies the move on market concentration: if the main free CA had a problem, much of the web would have no free, automated alternative ready to replace it.

What changes for decision-makers

Nothing immediate for the web certificates already in use. But the announcement confirms the direction of travel: on the web, the post-quantum authentication that Chrome favours does not mean putting post-quantum signatures into today’s X.509 chains, but a new format that will coexist with the classical one for years. Anyone managing large numbers of certificates has two tasks that do not depend on that date: knowing which certificates they have and where, and automating their renewal, which Cloudflare’s new CA, for example, will require.