Cloudflare announced plans to become a public certificate authority on September 29, 2026, alongside a Merkle Tree Certificate direction for post-quantum authentication. The announcement establishes a roadmap and trust-program milestones, not universal browser acceptance or a completed migration for every website.
Becoming a trusted CA has several milestones
The CA announcement says Cloudflare has applied to major root programs and agreed to acquire an established GlobalSign root. Applying, acquiring, issuing, and being accepted across clients are different steps.
For a site operator, the relevant outcome is whether the clients used by customers can validate the certificate chain. A browser’s current behavior does not establish compatibility with an embedded device, an older operating system, or a partner’s custom TLS client. Evaluate the complete customer population before changing certificate assumptions.
Post-quantum key exchange and authentication are distinct
Cloudflare’s architecture post targets early 2027 for Merkle Tree Certificate inclusion in Chrome’s quantum-resistant root store. It presents MTCs as a way to reduce the overhead of post-quantum certificate authentication.
Encrypting a connection and authenticating the remote server are related but separate requirements. A site should avoid describing its entire connection as quantum resistant based on one negotiated component. Keep technical claims tied to the actual handshake and client support observed in the deployment.
Inventory the dependencies before a migration
List who issues certificates, how renewal is automated, which monitoring detects unexpected issuance, and which clients must remain compatible. Include internal services and machine clients, not only the main website. Document where certificate pinning or custom trust stores constrain a change.
Test failure scenarios: an expired certificate, an unavailable issuer, and a client that lacks the new trust path. Recovery procedures should be understood before the first production renewal under a new arrangement. A future architecture improvement should not make ordinary certificate operations harder to diagnose.
A roadmap worth tracking without premature claims
The plan matters because authentication overhead and trust distribution affect deployment at internet scale. Its immediate value is to give platform and security teams a concrete direction to monitor.
Keep existing certificate monitoring and renewal checks active while the new milestones develop. Revisit adoption when issuance, supported clients, and operational guidance are available. A technically promising certificate design earns production confidence through interoperability and observable operations.