Cloudflare to Become a Public Certificate Authority, Targeting Post-Quantum Certificates in Early 2027

On September 29, 2026 Cloudflare announced its intent to become a public certificate authority. It says it has applied to the Chrome, Apple, Microsoft and Mozilla root programs and signed an agreement to acquire an established root from GlobalSign, and that it is not issuing certificates yet. In a companion post the company says the new authority will issue Merkle Tree Certificates, a post-quantum design that keeps large post-quantum signatures off every connection, targeting early 2027 for inclusion in Chrome's Quantum-resistant Root Store.

Post-quantum key exchange already protects much of today's web traffic. Authentication, the certificates that prove a server is who it says it is, has been the harder half. These are company plans rather than delivered service, but a large certificate issuer committing to a date moves the public web closer to end to end quantum-safe TLS.

Our take

The public web is getting quantum-safe certificates on a schedule. Private networks will not get them automatically: internal certificate authorities, VPN gateways, SCADA links and device management certificates are yours to inventory and plan. The question to answer now is which of your certificates and trust chains still depend on RSA or elliptic curve signatures, and which equipment can accept a new certificate type without replacement. The hardware stays. The keys change.