Cloudflare launches its own public Certificate Authority

Cloudflare, a key player in global web infrastructure, has announced plans to create its own dedicated public Certificate Authority (CA) and independently provide free TLS certificates for websites. This move aims to reduce reliance on third-party providers and improve service stability in ensuring internet security. This is reported by Ixbt.com reports .

According to Ixbt.com, the company has already submitted official applications to include its root certificates in the trust stores of leading platforms such as Chrome, Apple, Microsoft, and Mozilla. To ensure full compatibility with legacy devices, Cloudflare has reached an agreement to acquire an existing root certificate from GlobalSign. This certificate has been supported by most browsers and operating systems since 2012.

Technical solutions and security mechanisms

One of the biggest challenges for new Certificate Authorities is that distributing root certificates to all devices can take years, and outdated hardware may never receive them. The GlobalSign certificate prevents such issues, guaranteeing compatibility with the widest range of devices. At the same time, Cloudflare is developing its own entirely new root certificates that meet the requirements of future browsers and operating systems.

The processes for obtaining and renewing certificates will be fully automated using the open ACME protocol, which is also actively used by other free authorities. Cloudflare notes that users of existing solutions will not need to install new tools or rebuild complex server infrastructure — simply changing the ACME directory URL is sufficient.

Network stability and future security

Currently, a significant portion of free certificates on the internet falls on a limited number of providers. For instance, the Let's Encrypt service supports over 500 million sites and issues nearly 10 million certificates daily. Cloudflare warns that a serious failure at such large authorities could negatively impact the entire global network, emphasizing the need for an alternative and scalable solution.

The company promises to ensure a high level of reliability and transparency in its new authority. Specifically, reproducible software builds will be published, information about Hardware Security Modules (HSM) used for key storage will be disclosed, and a dedicated public dashboard for monitoring incidents will be launched.

Preparation for post-quantum cryptography

Looking toward future technologies, Cloudflare is also actively preparing for the era of post-quantum cryptography. The company plans to be one of the first authorities to issue Merkle Tree Certificates (MTC). The first documents of this type are expected to be presented in the first quarter of 2027.

While traditional TLS certificates will not lose their relevance, MTC serves as a more compact authentication mechanism for large chains required by post-quantum security. Cloudflare aims to integrate standard WebPKI and MTC standards within a single service, ensuring a gradual transition period for users.