Analyst(s): Fernando Montenegro
Publication Date: October 2, 2026
Cloudflare plans to become a public certificate authority, with production post-quantum Merkle Tree Certificates targeted for the first quarter of 2027. We see a credible move on the harder, signature side of the migration, though browser root programs will set the pace.
What Is Covered in This Article:
- Cloudflare will issue classical and post-quantum certificates from a single certificate authority (CA), backed by a GlobalSign root and pending applications with four browser root programs.
- Merkle Tree Certificates (MTCs) address the 40x size problem of post-quantum signatures, and the Chrome experiment showed faster handshakes.
- Browser root programs, not Cloudflare, control the timeline, and Let’s Encrypt is pursuing free MTCs on a similar schedule.
- A second free, large-scale issuer helps the resilience of the web’s public key infrastructure (PKI), but pairing the content delivery network (CDN) and CA roles within one provider is a dependency customers should weigh carefully.
- Internal PKI, not public certificates, remains where most enterprise post-quantum exposure sits.
The News: On September 29, 2026, Cloudflare announced its intent to become a public certificate authority (CA), issuing both classical Transport Layer Security (TLS) certificates and post-quantum Merkle Tree Certificates (MTCs) from a single system. The company has signed a definitive agreement to acquire publicly trusted root CA key material from GlobalSign, a root trusted since 2012, so its certificates will be recognized on older devices; the deal is expected to close within two months. Cloudflare has also applied to the Chrome, Apple, Microsoft, and Mozilla root programs, with classical issuance to begin after acceptance and production MTC issuance targeted for the first quarter of 2027.
MTCs, specified in an Internet Engineering Task Force (IETF) draft that Cloudflare co-authored, allow a client to verify that a certificate appears in a public log using a lightweight proof, so large post-quantum signatures do not travel with every connection. Issuance will run through the Automatic Certificate Management Environment (ACME) protocol, and MTCs will be free.
Cloudflare Becomes a Certificate Authority to Tackle Post-Quantum Signatures
Analyst Take: Most of the post-quantum conversation so far has centered on key exchange, and for understandable reasons: hybrid key agreement using ML-KEM (the Module-Lattice-Based Key-Encapsulation Mechanism) is already on by default in major browsers and across large parts of the web, which makes it the part of the migration that is, comparatively, going well. The harder half is authentication, meaning the signatures and certificate chains that tell a browser it is talking to the right server.
We see Cloudflare’s announcement as one of the more consequential moves on that harder half so far, and it comes from a company with a credible record of turning difficult cryptography into a default (by Cloudflare’s own count, Universal SSL, its free Secure Sockets Layer certificate program, doubled the web’s encrypted traffic overnight back in 2014). That record carries into enterprise security spending: in ETR’s October 2026 TSIS survey, which measures second-half planned spend against first-half actuals, Cloudflare posted a Net Score of 29 (N=461) in ETR’s Information Security sector, roughly double the sector’s overall Net Score.
Cloudflare Is Taking On PKI, the Hardest Migration Target
We feel PKI is the hardest and highest-stakes target in any post-quantum program, since every post-quantum connection downstream depends on a post-quantum chain of trust. The obstacle with simply swapping in post-quantum signatures is size: by Cloudflare’s figures, they run roughly 40x larger than today’s, which would bloat every handshake and certificate transparency storage by the same factor. MTCs sidestep much of that by having the client verify a compact inclusion proof against a public log rather than carrying a stack of heavy signatures.
Authentication also carries a different kind of risk. There is no harvest-now, decrypt-later problem for a web certificate, which only has to resist forgery while it is valid, which is why key exchange sensibly went first. The case for starting on certificates now is lead time: moving the web’s roots of trust means years of root-program review, browser support, and parallel operation, and Google has already pulled its own internal migration target into 2029.
To us, the credibility comes less from the press release and more from the work behind it. Cloudflare co-authored the IETF draft, and its experiment with Chrome served billions of MTCs to Chrome Beta users, with median handshakes 9% faster than a classical chain.
Building the CA on a fork of Let’s Encrypt’s Boulder software, and issuing only to clients that support ACME Renewal Information (ARI), also points to a team that expects certificate lifetimes to keep shrinking, with the CA/Browser Forum schedule reaching 47 days in 2029, and automation to stop being optional.
One gap in the specifics: neither the announcement nor Cloudflare’s technical posts name the post-quantum signature algorithm the CA will use for production MTCs, which is the first question a careful buyer should ask.
The Timeline Belongs to the Browsers
Cloudflare does not, however, control the pace here. Chrome’s quantum-resistant root program, per its published plan, only begins onboarding MTC CAs in its third phase, targeted for the third quarter of 2027, and Apple, Microsoft, and Mozilla have yet to publicly commit to MTC support. Servers will also need classical fallback certificates for clients without current landmark data, a point Cloudflare itself makes.
Nor is Cloudflare alone. Let’s Encrypt is targeting a production MTC environment in 2027, likewise free and ACME-based, so free post-quantum certificates look set to become a contested space at the commodity end of the market. That puts pressure on commercial CAs such as DigiCert and Sectigo, among others, to compete in certificate lifecycle management and private PKI rather than in issuance, which is where we reckon much of their enterprise value already lies.
More Issuers, or a Different Kind of Concentration?
Cloudflare’s stated rationale is issuer diversity, and it is a fair one. Let’s Encrypt issues more than half of public certificates, and the 2024 distrust of Entrust by Chrome and Mozilla showed how disruptive losing a single CA can be. A second free, high-scale issuer makes for a healthier Web PKI.
We would offer a less comfortable read alongside that. A site using Cloudflare as both a CDN and a CA would have one company terminate its traffic and vouch for its identity. That is not unprecedented (Google runs Chrome’s root program and also operates Google Trust Services), and Cloudflare’s transparency commitments, including independent cosigners, reproducible builds, and a public health dashboard, are the right mitigants, though transparency into how the CA operates does not change the fact that one company would hold both roles. How much of that dependency to accept is a decision each organization should make deliberately rather than by default.
What It Means for Enterprise Teams
For most organizations, public-facing certificates were never the hardest part, because browser root programs act as a forcing function, and failures are immediately visible. Internal PKI has no equivalent forcing function, and that is where we expect most residual exposure to sit for years.
There is a compliance trap in that split as well. Auditors and regulators can readily see public-facing certificates, so an organization that moves its web endpoints onto post-quantum certificates may satisfy most early requirements while its internal PKI stays classical.
Our own data points in the same direction. In the Futurum 1H 2026 Cybersecurity Decision-Makers Survey, nearly half of network security respondents (N=100) identified certificate lifecycle sprawl and the inability to rotate certificates automatically at scale as among their top three hurdles in preparing network infrastructure for quantum-era cryptography.
The compliance clock adds pressure, too. Executive Order 14412 directs federal agencies to move high-value systems to post-quantum key establishment by the end of 2030 and to post-quantum signatures by the end of 2031, with contractor requirements to follow. Cloudflare’s own phrase, “a multi-decade migration,” is the right planning assumption: classical and post-quantum certificates will run side by side well past 2027, and teams should budget for that parallel period as a steady state, not a project with an end date.
What to Watch:
- Will Apple, Microsoft, and Mozilla follow Chrome on MTCs? Cloudflare’s post-quantum path runs largely through Chrome today, and support from the other root programs decides whether MTCs become a web default or stay a Chrome-specific optimization.
- What does the GlobalSign deal actually transfer? The acquired root is what gives Cloudflare reach into older devices. Watch for details on which roots move and how GlobalSign’s own certificate business continues afterward.
- Will classical certificates be free too? Cloudflare has committed to free MTC issuance but has not said how it will price classical certificates, which shapes how directly it competes with Let’s Encrypt and commercial CAs.
- Do PKI vendors shift their pitch to private PKI? As public issuance commoditizes, expect DigiCert, Sectigo, Keyfactor, and others to lean harder on post-quantum capabilities for internal certificates, where most of the exposure remains.
- How will customers weigh a CDN-plus-CA dependency? Some organizations will welcome a single provider for traffic and identity; others, particularly in regulated industries, may deliberately keep the two roles with separate providers.
For more information, read the full announcement from Cloudflare here.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Other Insights From Futurum:
Can Cloudflare and Wiz Close the AI Security Visibility Gap?
CISA and G7 Make PQC Transition an Immediate Imperative
A Loud Floor and a Quiet Gap: Security Summer Camp 2026
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
