Cloudflare Aims to Become a Public Certificate Authority
The company plans to issue free TLS certificates and lead in post-quantum cryptography.
1Cloudflare's CA ambitions
Cloudflare has announced its intent to become a public certificate authority (CA), marking a significant shift from being one of the largest consumers of certificates to issuing them. The company has applied for inclusion in root programs of major browsers like Chrome, Apple, Microsoft, and Mozilla. Additionally, Cloudflare has signed an agreement to acquire a trusted root from GlobalSign, ensuring broad device compatibility from day one. This move aims to decentralize the certificate ecosystem and reduce reliance on a single dominant provider like Let's Encrypt.
2Addressing systemic risk
The current free certificate model, dominated by Let's Encrypt, poses systemic risks. If Let's Encrypt faces issues, much of the web lacks a comparable free alternative. Cloudflare's new CA will provide redundancy, similar to how its Universal SSL certificates include backup certificates. The company plans to use the ACME protocol for automated issuance, making adoption seamless for existing users of free CAs. This approach ensures that the encrypted web remains resilient against single points of failure.
3Post-quantum cryptography
Cloudflare aims to be among the first CAs to issue post-quantum certificates, targeting Chrome's Quantum-resistant Root Program. The company plans to issue Merkle Tree Certificates (MTCs) by early 2027, a compact solution designed for a post-quantum world. MTCs address the growing strain on TLS handshakes caused by traditional certificate chains. Cloudflare has been advocating for MTCs at the IETF, and Chrome has endorsed them as the preferred path for post-quantum authentication.
4Dual-root strategy
Cloudflare is adopting a dual-root strategy to maximize compatibility. The acquired GlobalSign root, trusted since 2012, ensures coverage for older devices that no longer receive updates. A new root, submitted for inclusion in key programs, is designed for future policies, including those capping root age. This dual approach guarantees that Cloudflare's certificates will work across both legacy and modern systems, providing the widest possible customer compatibility.
5Transparency and resilience
Cloudflare commits to building a transparent and resilient CA. The company will publish reproducible builds of its signing software, attest its hardware security modules, and maintain a public dashboard for issuance health. Renewal automation will be mandatory, requiring clients to support ACME Renewal Information (ARI). These measures ensure that the CA can 'fail small,' limiting the impact of any single issue and maintaining high reliability.
6Certificate growth projections
Cloudflare, which handles over 20% of global internet traffic, relies on millions of certificates annually. As certificate validity periods shorten and post-quantum certs emerge, demand is expected to grow rapidly. The company's experience with rate limits, revocation latency, and root distribution lag informs its CA design. By becoming a CA, Cloudflare aims to stabilize the certificate supply chain and provide more options for its customers.
7Customer Zero approach
Cloudflare will be the first user of its new CA, ensuring that the infrastructure meets its high standards. The company consumes certificates from multiple CAs for its operations and will test the new system at scale. This 'Customer Zero' approach mirrors Cloudflare's product development philosophy, where internal use precedes public release to identify and resolve issues early.
8Timeline and next steps
Cloudflare is currently navigating the application and approval process with major root programs. The company will share updates as it progresses toward issuing its first Merkle Tree Certificates in early 2027. Interested parties can register for updates to stay informed. Cloudflare will continue collaborating with existing partner CAs to maintain a trusted and open internet during this transition.
9A long-term vision
Cloudflare's CA initiative reflects its broader mission to enhance internet security and accessibility. By providing free, automated certificates and leading in post-quantum cryptography, the company aims to strengthen the foundational trust layer of the web. This move builds on its 2014 Universal SSL launch, which dramatically expanded encrypted web traffic, and underscores its commitment to an open, resilient internet.
Original article: Cloudflare Blog — Cloudflare Aims to Become a Public Certificate Authority