Building a post-quantum certificate authority with Merkle Tree Certificates
Cloudflare becomes a certificate authority offering free Merkle Tree Certificate issuance, targeting Chrome's quantum-resistant root store inclusion in early 2027.
Cloudflare announced it is becoming a certificate authority that will support Merkle Tree Certificates (MTCs), an IETF PLANTS draft specification that batches certificates into an append-only Merkle tree signed at the root for compact post-quantum verification. The company targets early 2027 for inclusion in Chrome's newly launched Quantum-resistant Root Store, following a successful experimental deployment with Chrome, and will provide standard MTC issuance at no cost. Cloudflare notes post-quantum signatures are roughly 40 times larger than classical ones and would balloon certificate transparency log storage by 40x, motivating the MTC approach for authenticating roughly a billion TLS servers. Cloudflare also operates the Nimbus CT log family and is launching Raio, a new family of static CT logs.