Cloudflare is establishing its own public Certificate Authority to issue free TLS certificates. The company has submitted applications to include its root certificates in the trust programs of Chrome, Apple, Microsoft, and Mozilla. To ensure compatibility with older devices, Cloudflare is acquiring an existing root certificate from GlobalSign, which has been supported by browsers and operating systems since 2012.
The issuance and renewal process will be automated via the ACME protocol. Users of existing solutions will only need to update their ACME directory URL without modifying server infrastructure. Cloudflare aims to reduce reliance on a limited number of providers, noting that Let's Encrypt currently serves over 500 million websites and issues approximately 10 million certificates daily.
The new CA will prioritize resilience by requiring support for automated renewal and the ACME Renewal Information mechanism. This allows for rapid replacement of certificates if vulnerabilities are detected. Cloudflare plans to maintain transparency by publishing reproducible software builds, disclosing hardware security module information, and launching a public monitoring dashboard.
Looking toward post-quantum cryptography, Cloudflare intends to be among the first to issue Merkle Tree Certificates. These are expected to debut in the first quarter of 2027 as a compact authentication method for post-quantum TLS. The company will continue to support classic WebPKI alongside MTC to facilitate a gradual transition to new standards.
Cloudflare has not yet announced a specific launch date for its full-scale CA service, as it awaits approval from major browser and operating system vendors. Until these processes are finalized, the company will continue to rely on certificates from its existing partners to secure the traffic passing through its infrastructure, which accounts for over 20% of global web traffic.
