--- title: Cloudflare Plans Public Certificate Authority for... description: Cloudflare announced plans to become a public Certificate Authority issuing both traditional TLS certificates and post-quantum Merkle Tree Certificates (MTCs).... canonical: https://daily.dev/posts/cloudflare-plans-public-certificate-authority-for-post-quantum-security-wpc20tlhq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cloudflare Plans Public Certificate Authority for Post-Quantum Security | daily.dev og:description: Cloudflare announced plans to become a public Certificate Authority issuing both traditional TLS certificates and post-quantum Merkle Tree Certificates (MTCs).... og:url: https://daily.dev/posts/cloudflare-plans-public-certificate-authority-for-post-quantum-security-wpc20tlhq og:image: https://api.daily.dev/og/posts/WPC20TlhQ.png og:image:alt: Cloudflare Plans Public Certificate Authority for Post-Quantum Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare Plans Public Certificate Authority for Post-Quantum Security **[The Quantum Insider](https://daily.dev/sources/thequantuminsider)** · 4 min read · 0 upvotes · 0 comments ## Summary Cloudflare announced plans to become a public Certificate Authority issuing both traditional TLS certificates and post-quantum Merkle Tree Certificates (MTCs). The company is acquiring publicly trusted Root CA key material from GlobalSign and has applied to join the Chrome, Apple, Microsoft, and Mozilla root programs. Classical certificate issuance will begin after the browser root program approval process, while production MTC issuance is scheduled for Q1 2027. The new CA aims to reduce reliance on a small number of dominant issuers, add operational transparency via a public health dashboard and reproducible builds, use RFC 9773 automated renewal signaling for zero-downtime certificate replacement, and let site owners manage both classic and post-quantum certificates in one system. The GlobalSign acquisition is expected to close within two months. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Cloudflare's plan for a public certificate authority and post-quantum certificates? Cloudflare announced it will become a public Certificate Authority issuing both traditional TLS certificates and new post-quantum Merkle Tree Certificates (MTCs). It is acquiring publicly trusted Root CA key material from GlobalSign and has applied to Chrome, Apple, Microsoft, and Mozilla root programs. Classical certificate issuance starts after root program approval, with production MTC issuance targeted for Q1 2027. _daily.dev helps teams track PKI shifts like this before planning a certificate infrastructure upgrade._ ### What are Merkle Tree Certificates (MTCs) and how do they help with post-quantum security? Merkle Tree Certificates are a post-quantum certificate format, co-authored by Cloudflare as an IETF draft, that verify a certificate is logged in a trusted registry using lightweight proofs instead of transmitting heavy post-quantum signatures on every connection. This keeps post-quantum protection scalable without the performance cost of larger signature sizes on each TLS handshake. _Developers weighing post-quantum TLS options can follow specs like MTC through daily.dev._ ### When will Cloudflare's Root CA acquisition from GlobalSign close and when will certificate issuance start? Cloudflare's acquisition of publicly trusted Root CA key material from GlobalSign is expected to close within two months, subject to customary closing conditions. Classical TLS certificate issuance will begin after Cloudflare completes the browser root program application process with Chrome, Apple, Microsoft, and Mozilla, while production MTC issuance is scheduled to start in Q1 2027. _Site owners planning ahead for certificate migrations can track timelines like this via daily.dev._ ## Similar posts on daily.dev - [Keeping the Internet fast and secure: introducing Merkle Tree Certificates](https://daily.dev/posts/keeping-the-internet-fast-and-secure-introducing-merkle-tree-certificates-blu0ryjsr) · Cloudflare · 2 upvotes · 0 comments - [Web PKI Reimagined with Merkle Tree Certificates](https://daily.dev/posts/web-pki-reimagined-with-merkle-tree-certificates-ancuapixf) · Feisty Duck · 0 upvotes · 0 comments - [Cloudflare Proposes Merkle Tree Certificates to Solve Post-Quantum TLS Performance Issue](https://daily.dev/posts/cloudflare-proposes-merkle-tree-certificates-to-solve-post-quantum-tls-performance-issue-8jpwvx4ft) · InfoQ · 0 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/cloudflare-plans-public-certificate-authority-for-post-quantum-security-wpc20tlhq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare Plans Public Certificate Authority for Post-Quantum Security","url":"https://daily.dev/posts/cloudflare-plans-public-certificate-authority-for-post-quantum-security-wpc20tlhq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cloudflare-plans-public-certificate-authority-for-post-quantum-security-wpc20tlhq"},"datePublished":"2026-09-29T15:08:14.390Z","dateModified":"2026-10-05T05:10:54.816Z","description":"Cloudflare announced plans to become a public Certificate Authority issuing both traditional TLS certificates and post-quantum Merkle Tree Certificates (MTCs)....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/67dabe96d205994db5059ab9538bbc3d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/67dabe96d205994db5059ab9538bbc3d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Quantum Insider","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Quantum Insider","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7b14a6b34c1b464c9e8a88d9a0dac951","url":"https://daily.dev/sources/thequantuminsider"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cloudflare-plans-public-certificate-authority-for-post-quantum-security-wpc20tlhq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,cloudflare","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Quantum Insider","item":"https://daily.dev/sources/thequantuminsider"},{"@type":"ListItem","position":3,"name":"Cloudflare Plans Public Certificate Authority for Post-Quantum Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cloudflare-plans-public-certificate-authority-for-post-quantum-security-wpc20tlhq#faq","mainEntity":[{"@type":"Question","name":"What is Cloudflare's plan for a public certificate authority and post-quantum certificates?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare announced it will become a public Certificate Authority issuing both traditional TLS certificates and new post-quantum Merkle Tree Certificates (MTCs). It is acquiring publicly trusted Root CA key material from GlobalSign and has applied to Chrome, Apple, Microsoft, and Mozilla root programs. Classical certificate issuance starts after root program approval, with production MTC issuance targeted for Q1 2027. daily.dev helps teams track PKI shifts like this before planning a certificate infrastructure upgrade."}},{"@type":"Question","name":"What are Merkle Tree Certificates (MTCs) and how do they help with post-quantum security?","acceptedAnswer":{"@type":"Answer","text":"Merkle Tree Certificates are a post-quantum certificate format, co-authored by Cloudflare as an IETF draft, that verify a certificate is logged in a trusted registry using lightweight proofs instead of transmitting heavy post-quantum signatures on every connection. This keeps post-quantum protection scalable without the performance cost of larger signature sizes on each TLS handshake. Developers weighing post-quantum TLS options can follow specs like MTC through daily.dev."}},{"@type":"Question","name":"When will Cloudflare's Root CA acquisition from GlobalSign close and when will certificate issuance start?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare's acquisition of publicly trusted Root CA key material from GlobalSign is expected to close within two months, subject to customary closing conditions. Classical TLS certificate issuance will begin after Cloudflare completes the browser root program application process with Chrome, Apple, Microsoft, and Mozilla, while production MTC issuance is scheduled to start in Q1 2027. Site owners planning ahead for certificate migrations can track timelines like this via daily.dev."}}]} ```