Cloudflare to launch public Certificate Authority for quantum-safe security

Cloudflare has announced plans to launch a public Certificate Authority (CA) to diversify web security and prepare for the era of quantum computing. To facilitate this transition, the company has signed a definitive agreement to acquire an established root from GlobalSign and has applied for inclusion in the root programs managed by Chrome, Apple, Microsoft, and Mozilla.

A key component of this initiative is the issuance of Merkle Tree Certificates (MTCs), which are designed to address the performance challenges of post-quantum cryptography. Traditional post-quantum signatures are significantly larger than classical keys, which could lead to massive certificate transparency log sizes and computational bottlenecks during TLS handshakes. MTCs mitigate this by batching certificates into an append-only Merkle tree, allowing browsers to verify certificates using lightweight inclusion proofs.

Cloudflare aims to provide an independent alternative to the current concentration of certificate issuers, such as Let's Encrypt, thereby reducing systemic risk within the Web PKI ecosystem. Production issuance of Merkle Tree Certificates is scheduled to begin in the first quarter of 2027.