Blog Post

Cloudflare Is Becoming a Certificate Authority

October 18, 2026 What is by admin

Certificates are the plumbing of the web. You only notice them when they break. So it is worth paying attention when Cloudflare announces it has applied to become a public certificate authority (CA) — the kind of organization that issues those certificates.

Here is the short version: the company that already encrypts a huge slice of the internet wants to issue the TLS certificates behind the padlock in your browser bar. It has applied to the four major browser and platform root programs and has agreed to buy an established trusted root from GlobalSign so its certificates work on older devices from day one. It is not issuing certificates yet, but the groundwork started in late September 2026.

If you run websites, manage servers, or sign off on SSL spending, this affects you. Here is what Cloudflare announced, why it matters, and what to do now.

What Happened

On September 29, 2026, during its annual Birthday Week, Cloudflare announced its intent to become a public certificate authority. The date was deliberate: twelve years earlier, during Birthday Week 2014, Cloudflare switched on Universal SSL and gave free TLS certificates to every site behind its network. By its own account, that move nearly doubled the number of encrypted sites on the web overnight.

Until now, Cloudflare has been one of the largest consumers of publicly trusted certificates on the internet — while never issuing a single one itself. That changes, in three ways announced the same day:

Applications filed. Cloudflare has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs. These are the default trust stores that decide which certificate authorities your browser, phone, and operating system believe out of the box.
A trusted root acquired. Cloudflare signed a definitive agreement to acquire an established, publicly trusted root from GlobalSign. That root has been trusted across browsers, operating systems, and devices since 2012. A brand-new root can take years to propagate to every client; the acquired one covers legacy devices that stopped receiving updates long ago.
Post-quantum plans. Cloudflare plans to be one of the first CAs to serve post-quantum certificates and is targeting Chrome’s new Quantum-Resistant Root Program. Production issuance of Merkle Tree Certificates (MTCs) — a compact new certificate format built for a post-quantum world — is scheduled for the first quarter of 2027.

The GlobalSign transaction is expected to close within two months, and conventional certificate issuance waits on the root program reviews. In other words: this is a public commitment, not a product launch.

What’s Happening Now

The strongest part of the announcement is the argument behind it: the free, automated certificate system the web depends on is a de facto monopoly, and Cloudflare wants to break up that concentration.

Today, most of the encrypted web runs on automated, free certificates — and much of that flows through Let’s Encrypt. By Cloudflare’s numbers, Let’s Encrypt issues on the order of ten million certificates a day, serves more than 500 million sites, and passed four billion active certificates in 2025. Cloudflare calls it one of the best things to happen to the internet in twenty years, and says that as one of its largest users. The risk is what happens if that one operator has a bad week. There is no comparable free, automated alternative ready to take the load.

Cloudflare knows this problem from the inside. It terminates TLS for millions of domains, sits in front of more than 20 percent of global internet request traffic, and has spent years provisioning backup certificates from different authorities so customer sites survive a CA outage or revocation. A public CA, Cloudflare argues, is that same redundancy idea applied to the whole internet.

Adoption is aimed at being painless. The new CA will be ACME-first — the same open protocol Let’s Encrypt uses. Anyone already pointed at an existing free CA can move by changing one directory URL in their ACME client, with no new tooling. Cloudflare’s own ACME infrastructure will be built on a fork of Boulder, the software that powers Let’s Encrypt.

The resilience commitments are unusual for a CA, and worth listing:

Renewal automation is a condition of issuance. Cloudflare will only issue to clients that support ACME Renewal Information (ARI), standardized in RFC 9773. Clients must poll the renewal endpoint and act on published renewal windows. If Cloudflare ever has to retire certificates early, it can bring renewal windows forward and stagger replacements instead of stranding sites.
Operational transparency. Cloudflare plans to publish reproducible builds of the software that signs certificates, attest the hardware security modules holding its keys, and run a public dashboard for issuance health and incidents. As the blog post puts it: audits are point-in-time and tell you a CA passed, not how it runs on an ordinary Tuesday.

Then there is the post-quantum angle, and it may be the more interesting long game. Quantum computers that can break today’s public-key cryptography are expected within years, and browser makers are on a clock: Chrome has set public goals around post-quantum migration by 2029. The catch is size. Post-quantum signatures are roughly 40 times larger than classical ones, and standard certificate chains would strain TLS handshakes and certificate transparency logs alike.

Merkle Tree Certificates solve that by batching certificates into an append-only Merkle tree signed once, verified with compact inclusion proofs. The design motto is “don’t log what you issue — issue by logging,” which makes transparency a built-in property instead of a bolted-on log. Cloudflare co-authored the IETF draft, and Chrome has named MTCs its preferred path for post-quantum authentication. Standard MTC issuance will be free.

The practical part for site owners: Cloudflare will carry classic certificates and MTCs under one CA, one lifecycle, one set of guarantees. You will not have to pick a side of a multi-decade migration or run two systems.

What This Means for You

A second free, automated option is coming. If your renewals run through Certbot, acme.sh, or similar, switching later means changing an ACME directory URL — not re-architecting anything. Competition in the free tier is genuinely good news for everyone who runs sites.
Renewal automation becomes table stakes. Certificate lifetimes keep shrinking, and Cloudflare will refuse to serve clients that cannot handle automated renewal signals. If your ACME tooling is old, updating it stops being optional.
Legacy devices stay covered. The GlobalSign root reaches back to 2012-era trust. If you serve the public — customers, tenants, patients — old phones and embedded clients matter, and a fresh root alone would break on them.
The post-quantum clock is real. Browser makers are targeting a post-quantum migration around 2029. You do not need to act today, but putting it on next year’s planning list is the difference between a smooth migration and a scramble.
Single-CA dependency is a risk worth checking. Almost every site depends on one free issuer today. The lesson from every CA incident of the last decade is the same: have a second path ready before you need it.

What You Can Do Now

Inventory your certificates. List where each one comes from, when it expires, and whether renewal is fully automated. You would be surprised how many orgs cannot answer this in an afternoon.
Check ARI support. Make sure your ACME client is current enough to support RFC 9773 renewal signals. Older clients will need an update before Cloudflare’s CA will issue to them.
Build a backup path. If everything runs through Let’s Encrypt today, stand up a second issuing option — even one you only use during incidents. Cloudflare’s own Universal SSL ships every certificate with a backup from a different authority; origin servers deserve the same treatment.
Sketch your post-quantum plan. Note which services and client fleets would strain under large PQ cert chains, and watch how MTC support lands in your browsers and tooling through 2027.
Follow the rollout. Cloudflare is publishing milestones as they land and taking early-access signups. Nothing is replacing your current workflow in the meantime.

Cloudflare spent twelve years making encryption free and automatic for millions of sites. Becoming a CA is the same argument carried one layer down — now applied to the trust that makes encrypted connections possible at all. The root program reviews will take time, and there will be plenty of scrutiny from the WebPKI community in the meantime. Watch this one.

Sources:

Need help sorting out your SSL setup? I can help you plan, secure, and support your technology without making it harder than it needs to be. Reach out and let’s talk.

Write a comment