Cloudflare, which handles over 20% of global web traffic, announced in September 2026 that it will begin issuing its own security certificates. The company plans to release its first quantum-resistant certificates in the first quarter of 2027. To facilitate this, Cloudflare is utilizing a root certificate from GlobalSign, which has been recognized by browsers and operating systems since 2012.
The market for web security certificates is heavily influenced by browser developers, including Google, Apple, Microsoft, and Mozilla. These companies maintain root certificate programs that determine site trust. As of September 2026, Chrome held a 66.4% market share. New regulations will progressively reduce the maximum validity period for certificates to 200 days in 2026, 100 days in 2027, and 47 days by 2029.
Cloudflare currently serves over 27% of all websites globally, with an 86% share among sites using reverse proxies. In 2025, the company reported revenue of $2.17 billion, while competitors Fastly and Akamai recorded $624 million and $4.21 billion respectively. The company also faces regulatory pressure, including a €14.2 million fine from the Italian regulator AGCOM in January 2026.
The landscape of digital trust has seen significant consolidation and high-profile acquisitions. In 2010, VeriSign sold its authentication business to Symantec for $1.28 billion. Later, in 2018, DigiCert acquired Symantec’s web security division for $950 million and a 30% stake. These entities operate within a framework where private corporations effectively act as the primary regulators of internet security.
