Cloudflare Becomes a Certificate Authority to Tackle Post-Quantum Signatures

Analyst(s): Fernando Montenegro
Publication Date: October 2, 2026

Cloudflare plans to become a public certificate authority, with production post-quantum Merkle Tree Certificates targeted for the first quarter of 2027. We see a credible move on the harder, signature side of the migration, though browser root programs will set the pace.

What Is Covered in This Article:

• Cloudflare will issue classical and post-quantum certificates from a single certificate authority (CA), backed by a GlobalSign root and pending applications with four browser root programs.
• Merkle Tree Certificates (MTCs) address the 40x size problem of post-quantum signatures, and the Chrome experiment showed faster handshakes.
• Browser root programs, not Cloudflare, control the timeline, and Let’s Encrypt is pursuing free MTCs on a similar schedule.
• A second free, large-scale issuer helps the resilience of the web’s public key infrastructure (PKI), but pairing the content delivery network (CDN) and CA roles within one provider is a dependency customers should weigh carefully.
• Internal PKI, not public certificates, remains where most enterprise post-quantum exposure sits.

The News: On September 29, 2026, Cloudflare announced its intent to become a public certificate authority (CA), issuing both classical Transport Layer Security (TLS) certificates and post-quantum Merkle Tree Certificates (MTCs) from a single system. The company has signed a definitive agreement to acquire publicly trusted root CA key material from GlobalSign, a root trusted since 2012, so its certificates will be recognized on older devices; the deal is expected to close within two months. Cloudflare has also applied to the Chrome, Apple, Microsoft, and Mozilla root programs, with classical issuance to begin after acceptance and production MTC issuance targeted for the first quarter of 2027.