Overview
- Cloudflare has announced plans to run a publicly trusted CA that will issue traditional TLS certificates and a post-quantum format called Merkle Tree Certificates (MTCs).
- The company applied to the Chrome, Apple, Microsoft, and Mozilla root programs and says classical certificate issuance will begin only after those vendor approvals are granted.
- Cloudflare agreed to acquire publicly trusted root key material from GlobalSign to make its certificates trusted on older devices and expects that deal to close in about two months subject to customary conditions.
- MTCs use a registry-plus-Merkle-proof model so browsers verify lightweight proofs instead of heavy post-quantum signatures, and Cloudflare plans production MTC issuance in Q1 2027.
- Cloudflare says it will provide automated renewal tooling, a public health dashboard, and reproducible builds to manage millions of certificates and to reduce dependence on a few dominant CAs.