TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESS
Cloudflare has applied to become a publicly trusted certificate authority offering free TLS certificates, the company said in a blog post Tuesday. It has applied to the root programs run by Google Chrome, Apple, Microsoft and Mozilla, and plans to issue post-quantum-ready Merkle Tree Certificates starting in early 2027.
What Happened
To be trusted by browsers and operating systems, a certificate authority's root certificate must be accepted into each vendor's root store, a process that can take years before new roots reach older devices. Cloudflare is addressing that with a two-part plan. It has signed an agreement to acquire an established GlobalSign root that has been trusted across browsers, operating systems and devices since 2012, which gives it compatibility with older hardware from the start. In parallel, it is building a new root that it will submit to the root programs, designed for where the ecosystem is heading.
The service will be ACME-first, using the open Automated Certificate Management Environment protocol that Let's Encrypt popularized. Cloudflare says users could switch to it by changing a directory URL, without new tooling. Subscribers will also have to support ACME Renewal Information (ARI), standardized as RFC 9773, meaning their automation must check Cloudflare's renewal endpoint and renew within the windows it publishes.
RelatedCloudflare said it is not issuing certificates yet and that it will be "a little while" before it does. It will act as its own first customer, running its services on its own certificates before opening issuance to others.
Why It Matters
Free, automated certificates today depend heavily on Let's Encrypt, which Cloudflare says issues on the order of 10 million certificates a day and serves more than 500 million sites. Cloudflare presents its CA as redundancy for that system, a second large free source that could absorb demand if a dominant issuer suffers an outage or must mass-revoke certificates. ACME support means sites could move between the two without re-architecting.
Cloudflare's reach makes the entry significant. The company says it sits in front of more than 20% of global internet request traffic, and it already issues certificates to customers through its Universal SSL program, where each certificate ships with a backup issued by a different authority under a separate key.
The Post-Quantum Angle
The larger bet is on Merkle Tree Certificates (MTCs). Post-quantum signature schemes produce much larger signatures than today's algorithms, and traditional certificate chains built from them could grow large enough to strain TLS handshakes. MTCs are a more compact way to deliver publicly trusted certificates, and Cloudflare noted that Chrome has named them as its preferred path for post-quantum authentication. Cloudflare plans to be among the first CAs to issue production MTCs, with the first certificates in the first quarter of 2027.
The company also tied the move to shorter maximum certificate lifetimes coming over the next few years and to growth in automated, agent-driven traffic, both of which increase the volume of certificates that must be issued and renewed.
What to Watch
The immediate milestones are root program decisions from Chrome, Apple, Microsoft and Mozilla, which set no public timeline, and the closing of the GlobalSign root acquisition. After that, the first-quarter 2027 target for production MTCs will test whether the post-quantum certificate format is ready for broad deployment, and the ARI requirement will show how many operators' automation can keep up.
