Cloudflare has announced plans to become a public Certificate Authority (CA) to provide free TLS certificates for all websites and services. The project is currently in the stages of root certificate application, infrastructure development, and compliance auditing.
The company intends to acquire trusted root CA key materials from GlobalSign to establish its own root-level authority. Cloudflare is also pursuing inclusion in the root certificate programs of Chrome, Apple, Mozilla, and Microsoft to ensure broad browser and system compatibility.
The new CA will prioritize support for the ACME protocol, enabling automated certificate issuance and renewal. Users currently utilizing services like Let's Encrypt will be able to switch by updating their ACME directory URL without needing to overhaul their existing deployment tools.
To enhance security and reliability, Cloudflare will mandate client support for ACME Renewal Information. This feature allows for staggered background renewals, preventing mass certificate expiration. The company also committed to providing reproducible software builds and a public status dashboard.
