Cloudflare has announced it is applying to become a certificate authority (CA), twelve years after launching Universal SSL. The company frames the move as an effort to build what it calls a post-quantum CA for the open web, rather than simply issuing more certificates through existing trust hierarchies. The core idea is to control the full issuance path—root trust, automation, and the certificate format itself—so it can evolve TLS trust alongside emerging cryptographic requirements.
The concrete changes outlined in the announcement include:
- An application to operate as a certificate authority, moving beyond its prior role of obtaining certificates from external CAs for Universal SSL.
- Use of an established root, giving the new CA a trust anchor that predates this application rather than starting from a brand-new, untrusted root.
- An ACME-first approach, meaning automation via the ACME protocol is the primary issuance path rather than an afterthought layered onto manual processes.
- Support for Merkle Tree Certificates, a certificate format designed to reduce reliance on traditional signature schemes and improve scalability.
- A stated goal of being post-quantum, preparing TLS trust for the eventual arrival of quantum computers capable of breaking current public-key cryptography.
For developers, the practical implication is that certificate automation may become more tightly integrated and eventually more quantum-resistant without requiring application-level changes. If Cloudflare's CA is trusted by browsers and clients, teams already using ACME clients for renewal—such as those managing Let's Encrypt or other issuers—could see an additional issuer option that fits existing tooling. The ACME-first design also suggests fewer manual certificate workflows and more predictable renewals. Merkle Tree Certificates and post-quantum readiness matter because today's widely deployed signature algorithms are not expected to remain secure indefinitely; a CA built around those goals could make migration smoother for developers who depend on Cloudflare-terminated TLS.
Source: https://blog.cloudflare.com/cloudflare-certificate-authority/