Cloudflare announced plans to become a public certificate authority, issuing quantum-safe TLS certificates using Merkle Tree Certificates (MTCs) by Q1 2027, while acquiring GlobalSign’s root material to ensure compatibility with older devices.
The Quantum Challenge and Merkle Tree Certificates
Cloudflare’s move to establish a public certificate authority (CA) (Source 9) marks a pivotal step in securing the web against quantum computing threats. The company plans to issue both traditional TLS certificates and Merkle Tree Certificates (MTCs), which address the inefficiencies of post-quantum signatures. Unlike classical certificates, MTCs group multiple certificates into an immutable Merkle tree, allowing browsers to verify authenticity through compact proofs instead of transmitting large post-quantum signatures.
Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we’re taking the next step by building an open, transparent and reliable Certificate Authority for the entire Internet,
said Matthew Prince, CEO and co-founder of Cloudflare (Source 3). The company aims to balance support for older devices with post-quantum technology, ensuring the internet remains fast and secure amid evolving threats. To achieve this, Cloudflare has acquired publicly trusted Root CA key material from GlobalSign, ensuring compatibility with older smartphones, operating systems, and devices that no longer receive software updates (Source 9).
The underlying cryptographic transition is already supported by published standards. In August 2024, the US National Institute of Standards and Technology approved three major post-quantum cryptography standards, including FIPS 203 for ML-KEM and FIPS 204/205 for ML-DSA and SLH-DSA digital signature schemes (Source 4). However, deployment remains challenging, as browsers, servers, and software must agree on how to represent and verify these algorithms (Source 4). Cloudflare’s MTCs aim to mitigate performance issues by reducing the overhead of post-quantum signatures, which are approximately 40 times larger than classical ones (Source 8).
Browser Root Program Hurdles and GlobalSign Acquisition
To gain widespread trust, Cloudflare has applied to join the Chrome, Apple, Microsoft, and Mozilla root programs. However, conventional certificate issuance will follow browser root program acceptance, with production MTCs scheduled for Q1 2027 (Source 9). The company also agreed to acquire established, publicly trusted root CA key material from GlobalSign to ensure compatibility with older smartphones, operating systems, and devices that no longer receive software updates (Source 9).
By coupling issuance and logging, transparency becomes a requirement for operation, rather than an add-on,
said Cloudflare engineer Mari Galicer (Source 1). This integration ensures that certificate logging is embedded in the issuance process, enhancing security and reducing reliance on separate transparency mechanisms. Cloudflare’s new CA will also support Automated Certificate Management Environment (ACME), an open protocol for issuing and renewing certificates, allowing site owners to manage both classic TLS and MTCs in a unified system (Source 9).
Cloudflare Expands Role in Web Trust Infrastructure
Cloudflare’s initiative expands its role beyond distributing certificates issued by others, positioning it as a key player in the web’s trust infrastructure. The company plans to issue MTCs through the Automated Certificate Management Environment (ACME) protocol, enabling site owners to obtain them easily. This approach avoids the need for new tools or rebuilds, allowing websites to adopt post-quantum security incrementally (Source 9).
The transition to post-quantum security faces challenges, including the size of post-quantum signatures, which are roughly 40 times larger than classical ones (Source 8). Google, for instance, is developing a separate Chrome Quantum-resistant Root Store, while Cloudflare’s MTCs aim to mitigate performance impacts. Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we’re taking the next step by building an open, transparent and reliable Certificate Authority for the entire Internet,
said Matthew Prince, CEO and co-founder of Cloudflare (Source 2).
Cloudflare’s new CA will also support zero-downtime incident response by using automated renewal signaling (RFC 9773), enabling certificates to be replaced automatically across millions of sites (Source 1). This capability minimizes the risk of mass web outages during routine revocations or security updates. The company has tested MTCs in limited pilot programs, processing billions of certificates and showing that a TLS handshake with a landmark-relative MTC requires transmitting just one public key, one signature, and an inclusion proof smaller than 1 KB (Source 7).
Market Reaction and Financial Outlook
Cloudflare’s stock reflects investor confidence, with a USD 321.85 average one-year target from 33 ratings firms as of October 1, 2026 (Source 11). The company reported USD 696.06 million in revenue for Q2 2026, a 35.9% year-over-year increase. Its market capitalization reached USD 123.2 billion as of September 30, 2026, though shares traded 5.51% below the yearly high of USD 367.43 (Source 11).
Analysts highlighted Cloudflare’s strategic move to diversify its role in web security, reducing reliance on a small set of dominant certificate issuers. Let’s Encrypt issues on the order of ten million certificates a day, serves more than 500 million sites, and passed four billion active certificates in 2025.
(Source 3). The new CA aims to add an independent, high-scale issuer to this foundation, addressing systemic risks posed by concentration in certificate issuance (Source 9).
Cloudflare has also set a goal of completing its post-quantum readiness work by 2029, with MTC issuance dependent on technical development, third-party acceptance, and closing conditions (Source 6). The company’s plans align with broader industry efforts to prepare for quantum threats, as highlighted by its collaboration with Google on MTCs and its participation in the Internet Engineering Task Force (IETF) (Source 9).