Post-quantum website certificates from Cloudflare are scheduled for early 2027
Cloudflare will become a public certificate authority and plans post-quantum Merkle Tree Certificates in early 2027.
Cloudflare said it will become a public certificate authority, issuing conventional certificates and post-quantum Merkle Tree Certificates, with production MTC issuance planned for the first quarter of 2027. It agreed to acquire publicly trusted root key material from GlobalSign, expecting the deal to close within two months, so certificates work on older devices. Applications to the Chrome, Apple, Microsoft, and Mozilla root programs are pending, and classical issuance starts only after acceptance. MTCs, co-authored by Cloudflare as an IETF draft, use lightweight proofs so browsers can avoid sending heavy post-quantum signatures on every connection.
- Cloudflare plans to issue classic and post-quantum Merkle Tree Certificates.
- Production MTC issuance is scheduled for the first quarter of 2027.
- It is acquiring GlobalSign root material so older devices can trust its CA.
- Chrome, Apple, Microsoft, and Mozilla root-program applications remain pending.
- Sites can manage classic and MTC certificates without a forced cutover.
Full article407 words · extracted from helpnetsecurity.com · click to collapse
Cloudflare plans to become a public certificate authority (CA), an organization that issues the digital certificates websites use to encrypt traffic and prove who they are. The company said that its CA will issue conventional certificates and a post-quantum type called Merkle Tree Certificates (MTCs), with production MTC issuance scheduled for the first quarter of 2027.
Cloudflare says much of the web’s certificate issuing rests on a small set of dominant CAs, so one failure or compromise would spread widely. It also expects quantum computers able to break today’s encryption within years. A new high-scale issuer is its answer to the first problem, and MTCs are its answer to the second.
A root certificate tells browsers and devices whether to trust a CA. Cloudflare has agreed to acquire publicly trusted root key material from GlobalSign so its certificates are recognized on older phones and other devices that no longer get software updates. The company expects that deal to close within two months, subject to customary closing conditions. It has also applied to the Chrome, Apple, Microsoft and Mozilla root programs, and classical issuance begins only after that acceptance process finishes. All four applications are pending.
“Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we’re taking the next step by building an open, transparent and reliable Certificate Authority for the entire Internet,” said Matthew Prince, CEO and co-founder of Cloudflare. “Upgrading the web’s security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet. By balancing support for older devices with brand-new, post-quantum tech, we’re providing a permanent safety net—so the Internet stays fast, reliable, and secure for all devices, no matter what comes next.”
MTCs, which Cloudflare co-authored as an IETF draft specification, let a browser check that a certificate appears in a trusted registry using lightweight proofs. Post-quantum signatures are heavy, and MTCs avoid sending them with every connection. Cloudflare ran an experiment with Chrome first and is building on it.
Cloudflare also promises a live public health dashboard and reproducible code builds. It plans to use automated renewal signaling (RFC 9773) to replace certificates in the background across millions of sites during routine revocations or security updates. If you run a site, note that you will be able to manage classic and MTC certificates in one system, without a forced cutover.
Download eBook: Identity-First Threat Intelligence