Cloudflare Plans Public Certificate Authority for Post-Quantum Security

Insider Brief

• Cloudflare announced plans to establish a public Certificate Authority that will issue traditional TLS certificates and post-quantum Merkle Tree Certificates (MTCs).
• The company plans to acquire publicly trusted Root CA key material from GlobalSign and has applied to join the Chrome, Apple, Microsoft, and Mozilla root programs.
• Cloudflare expects classical certificate issuance to begin after the browser root program process, with production MTC issuance scheduled for Q1 2027.

PRESS RELEASE — Cloudflare, Inc. (NYSE: NET), the leading connectivity cloud company, today announced its intent to become a public Certificate Authority (CA), an open service that issues the digital certificates websites need to encrypt traffic and prove their identity to visitors. The new CA will support both traditional encryption and next-generation post-quantum Merkle Tree Certificates (MTCs), giving every website a path to stay protected as computing power advances—with no new tools or rebuilds required. Additionally, Cloudflare has agreed to acquire established, publicly trusted Root CA key material from GlobalSign, which will provide ubiquity across the global Web PKI ecosystem.

Every secure website depends on a certificate authority to verify its identity and enable encrypted connections. Today, that trust is concentrated in a small number of dominant issuers, creating systemic risk if any one of them fails or is compromised. At the same time, most certificate infrastructure was built before quantum computing became a practical concern. Quantum computers capable of breaking today’s encryption are expected within years, and much of the web is not prepared for that shift.