Cloudflare is set to become a public Certificate Authority, planning to issue both standard TLS certificates and post-quantum Merkle Tree Certificates (MTC). The company has submitted applications to include its root certificates in trust programs managed by Chrome, Apple, Microsoft, and Mozilla.
To support legacy devices, Cloudflare has signed an agreement to acquire existing trusted root key material from GlobalSign. This deal is expected to close within two months. The company intends to provide standard MTC certificates free of charge, with the first issuance scheduled for the first quarter of 2027.
Post-quantum signatures are approximately 40 times larger than classical ones, which increases data volume during TLS handshakes. MTC technology addresses this by using a Merkle tree structure to verify certificate inclusion, keeping the authentication data under 1 KB. In a 2026 experiment with Google, MTC handshakes were 9% faster than classical chains.
Cloudflare currently uses hybrid post-quantum key exchange for much of its TLS traffic. The firm aims to achieve full post-quantum protection across its product suite by 2029. The new certificate authority will support both classical and post-quantum certificate types to ensure compatibility with the existing Web PKI infrastructure for years to come.
