Cloudflare plans to become a public certificate authority (CA), an organization that issues the digital certificates websites use to encrypt traffic and prove who they are. The company said that its CA will issue conventional certificates and a post-quantum type called Merkle Tree Certificates ( MTCs ), with production MTC issuance scheduled for the first quarter of 2027.
Cloudflare says much of the web’s certificate issuing rests on a small set of dominant CAs, so one failure or compromise would spread widely. It also expects quantum computers able to break today’s encryption within years . A new high-scale issuer is its answer to the first problem, and MTCs are its answer to the second.
A root certificate tells browsers and devices whether to trust a CA. Cloudflare has agreed to acquire publicly trusted root key material from GlobalSign so its certificates are recognized on older phones and other devices that no longer get software updates. The company expects that deal to close within two months, subject to customary closing conditions. It has also applied to the Chrome, Apple, Microsoft and Mozilla root programs, and classical issuance begins only after that acceptance process finishes. All four applications are pending.
“Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we’re taking the step by building an open, transparent and reliable Certificate Authority for the entire Internet,” said Matthew Prince , CEO and co-founder of Cloudflare. “Upgrading the web’s security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet. By balancing support for older devices with brand-new, post-quantum tech, we’re providing a permanent safety net—so the Internet stays fast, reliable, and secure for all devices, no matter what comes .”
MTCs, which Cloudflare co-authored as an IETF draft specification, let a browser check that a certificate appears in a trusted registry using lightweight proofs. Post-quantum signatures are heavy, and MTCs avoid sending them with every connection. Cloudflare ran an experiment with Chrome first and is building on it.
Cloudflare also promises a live public health dashboard and reproducible code builds. It plans to use automated renewal signaling (RFC 9773) to replace certificates in the background across millions of sites during routine revocations or security updates. If you run a site, note that you will be able to manage classic and MTC certificates in one system, without a forced cutover.
Download eBook: Identity-First Threat Intelligence
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Malicious Custom GPT on chatgpt.com lures users into installing a RAT
Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)
Download: The High-Performance Team Playbook
Simplify security management with CIS SecureSuite Platform
Download: The IT and security field guide to AI adoption
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Webinar: Closing the accountability gap in AI-assisted delivery
Malicious Custom GPT on chatgpt.com lures users into installing a RAT
Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)
Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
