Cloudflare Announces Public Certificate Authority for the Post-Quantum Web

New Certificate Authority to Support Traditional Encryption and Post-Quantum Merkle Tree Certificates

Cloudflare has announced its plans to become a public Certificate Authority (CA), introducing an open service designed to issue the digital certificates websites use to encrypt traffic and establish their identity.

The planned Certificate Authority will support both traditional encryption and next-generation post-quantum Merkle Tree Certificates (MTCs). Cloudflare said the approach will give websites a way to prepare for advances in computing power without requiring new tools or a complete rebuild of their existing infrastructure. Public Certificate Authority fo…

Certificate Authorities are a core part of internet security, helping browsers and devices verify website identities and establish encrypted connections. Cloudflare noted that certificate issuance is currently concentrated among a relatively small number of major providers, creating potential systemic risks if one of them is compromised or experiences an outage.

At the same time, much of today's certificate infrastructure was developed before quantum computing became a major security consideration. Cloudflare said quantum computers capable of breaking current encryption are expected within years, leaving much of the web unprepared for the potential transition. Public Certificate Authority fo…

Cloudflare Targets More Open Certificate Infrastructure

Matthew Prince, CEO and co-founder of Cloudflare, said the company’s planned public CA builds on its efforts to make web encryption more accessible.

“Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we’re taking the next step by building an open, transparent and reliable Certificate Authority for the entire Internet,” said Prince.

He described preparing internet security for the arrival of quantum computing as a major coordination challenge. Cloudflare's approach is intended to combine compatibility with older devices and support for post-quantum technology while maintaining internet performance and reliability. Public Certificate Authority fo…

Root Certificate Planned to Support Legacy Devices

To improve compatibility with older smartphones, operating systems and other devices that no longer receive software updates, Cloudflare plans to acquire an established root certificate.

A root certificate allows browsers and devices to determine whether a Certificate Authority is trusted. Cloudflare said acquiring an established root will allow websites using its certificates to be recognized immediately, including on legacy hardware.

The company has also applied for inclusion in the root programs operated by Chrome, Apple, Microsoft and Mozilla. Cloudflare said the combination of the acquired root and these applications is intended to provide broad recognition for its certificates across the web. Public Certificate Authority fo…

Cloudflare will also begin moving toward production issuance of Merkle Tree Certificates, following an earlier experiment with Chrome. The certificates are designed to provide built-in transparency and support post-quantum security without sacrificing web speed or performance. Public Certificate Authority fo…

Public CA Builds on Universal SSL

Cloudflare's planned public CA follows the company's earlier work in web encryption.

In 2014, Cloudflare launched Universal SSL, providing free TLS certificates to millions of websites and doubling the amount of encrypted traffic on the web overnight, according to the company.

Today, automated free certificates are used across the majority of the encrypted web. Cloudflare said much of this infrastructure, however, remains dependent on a small group of dominant certificate issuers.

The new public CA is intended to introduce another independent, high-scale issuer into the certificate ecosystem. Public Certificate Authority fo…

Four Key Features of Cloudflare's Public CA

Cloudflare said its new public certificate infrastructure is being designed around modern requirements for scale, speed and transparency.

1. Glass-Box Operational Transparency

Cloudflare plans to go beyond traditional static audits by sharing detailed operational and technical information, publishing reproducible code builds and maintaining a live public health dashboard. This will allow the internet community to inspect the CA's operations in real time. Public Certificate Authority fo…

2. Zero-Downtime Incident Response

Through automated renewal signalling based on RFC 9773, Cloudflare plans to trigger background certificate replacements across millions of websites. The company says this could help minimize widespread web outages during certificate revocations and security updates. Public Certificate Authority fo…

3. Scalable Post-Quantum Security

Cloudflare's Merkle Tree Certificates are designed to verify that a certificate has been recorded in a trusted registry using lightweight proofs. The approach is intended to avoid sending large post-quantum signatures with every connection. Public Certificate Authority fo…

4. Frictionless Web Migration

Website owners will be able to manage traditional TLS certificates alongside next-generation Merkle Tree Certificates through a unified system. Cloudflare said this is intended to make the transition toward post-quantum security easier without requiring immediate infrastructure cutovers. Public Certificate Authority fo…

Classical Certificates to Come First

Cloudflare said it will begin issuing classical certificates after completing the relevant browser root program application and acceptance process.

Production issuance of Merkle Tree Certificates is scheduled to begin in Q1 2027. Website owners and developers will be able to follow engineering updates and sign up for early-access notifications through Cloudflare's blog. Public Certificate Authority fo…

The planned public Certificate Authority represents Cloudflare's effort to expand certificate infrastructure while preparing websites for security requirements associated with the future of quantum computing.