Cloudflare Applies to Become a Certificate Authority with Post-Quantum Features
Cloudflare has applied to become a certificate authority (CA), a notable step for the internet infrastructure company. Twelve years after introducing Universal SSL, Cloudflare is now focusing on enhancing internet security with post-quantum cryptography. Central to this initiative are Merkle Tree Certificates (MTCs), a method designed to address the vulnerabilities quantum computing poses to traditional cryptographic systems.
What Happened
On September 29, 2026, Cloudflare announced its application to become a certificate authority. This move reflects the company’s longstanding commitment to improving internet security. The proposed CA will use an established root, prioritize automation through the ACME protocol, and support the large-scale issuance of Merkle Tree Certificates. These features aim to simplify certificate management and strengthen defenses against quantum computing threats.
Why It Matters
The shift to post-quantum cryptography is urgent. Advanced quantum computers could eventually break widely used public-key algorithms, jeopardizing secure communications such as HTTPS connections.
By integrating post-quantum capabilities into its CA operations, Cloudflare is taking a proactive role in preparing for this challenge. Merkle Tree Certificates are especially significant because they address issues like the large size of post-quantum cryptographic signatures, which can slow TLS handshakes and complicate certificate transparency logs. If successful, Cloudflare’s CA could set a new benchmark for secure and efficient authentication in the quantum era.
Technical Details
Merkle Tree Certificates (MTCs) are the cornerstone of Cloudflare’s proposal. These certificates use Merkle trees, a cryptographic structure that enables compact and auditable authentication. MTCs aim to mitigate inefficiencies introduced by post-quantum signatures, which are larger than traditional ones.
For example, post-quantum signatures can increase the size of TLS handshakes, slowing secure connections. They can also complicate certificate transparency logs, which monitor for certificate misissuance. MTCs address these challenges by bundling multiple certificates into a compact structure, reducing overhead while preserving transparency and auditability.
Cloudflare also plans to adopt an ACME-first approach. ACME (Automated Certificate Management Environment) automates the issuance and renewal of certificates, aligning with Cloudflare’s goal of making advanced cryptographic tools widely accessible.
What Changes Now
If approved, Cloudflare’s CA could reshape how certificates are issued and managed. Merkle Tree Certificates offer a scalable solution to post-quantum challenges, potentially accelerating the adoption of quantum-resistant technologies.
For organizations, this could mean easier access to post-quantum-ready certificates without the usual performance trade-offs. For users, the benefits would include faster, more secure connections resilient to quantum threats.
Cloudflare’s entry into the CA space could also influence the broader ecosystem. By introducing innovations like MTCs and emphasizing automation, the company may encourage other CAs to adopt similar advancements, raising industry standards.
What Remains Unknown
Several questions remain unanswered. Cloudflare has not disclosed which post-quantum cryptographic algorithms its CA will support, a key factor in evaluating the system’s resilience.
Additionally, the timeline for approval and certificate issuance is unclear. Becoming a recognized certificate authority involves rigorous scrutiny and compliance with industry standards, which can take time.
Finally, it’s uncertain how the broader internet community—other CAs, browser vendors, and website operators—will respond. Adoption of technologies like MTCs often requires widespread collaboration and standardization, which can be challenging.
Final Thoughts
Cloudflare’s application to become a certificate authority reflects its commitment to addressing the security challenges posed by quantum computing. By leveraging Merkle Tree Certificates and prioritizing automation, the company aims to enhance cryptographic efficiency and resilience. While some details remain uncertain, this initiative underscores the importance of preparing for a post-quantum future.