Reposted from the neighboring Shaobing forum
IT Home, September 30 — Cloudflare announced on September 29 local time that it plans to become a public certificate authority (CA) and has formally applied to join the root certificate programs of Chrome, Apple, Microsoft, and Mozilla.
At the same time, Cloudflare has signed a definitive agreement with GlobalSign to acquire an existing root certificate with an extensive trust base, enabling certificates issued in the future to cover more operating systems, browsers, and devices.
IT Home note: Cloudflare has not yet begun issuing certificates. The related work is still in the application and approval stages.
Cloudflare said that its entry into the public CA sector is a further expansion of its internet encryption infrastructure following the launch of Universal SSL in 2014. At the time, Cloudflare provided free TLS for websites on its platform, prompting a large number of websites to adopt HTTPS by default.
For a newly created root certificate, the biggest challenge is that coverage must be built up over the long term. Even after receiving recognition from browser and operating system vendors, a new root certificate still needs to be gradually added to the trust stores of devices worldwide. Older devices that are no longer updated generally cannot receive new root certificates.
Therefore, Cloudflare plans to pursue two paths simultaneously. On the one hand, it will use the existing root certificate obtained from GlobalSign to cover trust systems already deployed in browsers, operating systems, and other devices. On the other hand, it will apply for a new root certificate that complies with the increasingly stringent policy requirements of future root certificate programs. Cloudflare said that the relevant GlobalSign root certificate has been trusted by various browsers, operating systems, and devices since 2012.
Cloudflare also plans to provide free automated certificate services, using ACME (Automated Certificate Management Environment) as the primary interface. The protocol is already widely used to automatically apply for and renew TLS certificates. In the future, users will be able to migrate their certificate management processes from an existing free CA to Cloudflare simply by changing the ACME directory URL, without having to redesign their infrastructure.
Cloudflare said that Let’s Encrypt currently issues approximately 10 million certificates per day, serves more than 500 million websites, and issued more than 4 billion active certificates cumulatively in 2025. Cloudflare believes that free automated certificate services are highly concentrated among a small number of CAs, creating a need for more public CAs with the same automation capabilities to provide redundancy.
Cloudflare itself already uses multiple CAs to provide certificates for customers and has established primary and backup certificate paths to address CA service interruptions, certificate revocations, and other situations. The company said that after establishing a public CA, it hopes to extend this redundancy mechanism across the entire internet.
In terms of reliability, Cloudflare plans to require clients using its CA to support automated renewal and to make ACME Renewal Information (ARI, a standard mechanism for providing clients with certificate renewal time windows) one of the conditions for certificate issuance. The relevant mechanism has been standardized as RFC 9773.
Cloudflare also plans to make information about its certificate issuance systems and operations public. This will include publishing reproducible builds of the software used to issue certificates, providing attestations for the hardware security modules that store CA keys, and offering public dashboards showing certificate issuance health and security incidents.
In addition to traditional TLS certificates, Cloudflare also plans to develop post-quantum cryptography. The company expects to begin issuing Merkle Tree Certificates (MTC) for production environments in the first quarter of 2027. These certificates are intended to reduce the TLS handshake burden caused by the continuously growing certificate chains associated with post-quantum cryptographic systems.
Cloudflare said that MTCs will not immediately replace traditional certificates. The internet will continue using existing WebPKI and traditional certificates in parallel for many years to come. The company plans to allow traditional certificates and MTCs to coexist within the same CA, enabling users to gradually migrate to post-quantum authentication according to their own circumstances.
Cloudflare is currently advancing the application and review processes for the Chrome, Apple, Microsoft, and Mozilla root certificate programs separately. The company expects to continue publicly reporting relevant developments, with the launch of the first Merkle Tree Certificates in early 2027 serving as an important milestone in the next phase.
