Automated certificates for everyone, built for today, and hardened for the era of quantum computing

Cloudflare, Inc. (NYSE:NET), the leading connectivity cloud company, today announced its intent to become a public Certificate Authority (CA), an open service that issues the digital certificates websites need to encrypt traffic and prove their identity to visitors. The new CA will support both traditional encryption and next-generation post-quantum Merkle Tree Certificates (MTCs), giving every website a path to stay protected as computing power advances—with no new tools or rebuilds required. Additionally, Cloudflare has agreed to acquire established, publicly trusted Root CA key material from GlobalSign, which will provide ubiquity across the global Web PKI ecosystem.

Every secure website depends on a certificate authority to verify its identity and enable encrypted connections. Today, that trust is concentrated in a small number of dominant issuers, creating systemic risk if any one of them fails or is compromised. At the same time, most certificate infrastructure was built before quantum computing became a practical concern. Quantum computers capable of breaking today's encryption are expected within years, and much of the web is not prepared for that shift.

"Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we’re taking the next step by building an open, transparent and reliable Certificate Authority for the entire Internet," said Matthew Prince, CEO and co-founder of Cloudflare. "Upgrading the web's security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet. By balancing support for older devices with brand-new, post-quantum tech, we’re providing a permanent safety net—so the Internet stays fast, reliable, and secure for all devices, no matter what comes next."

To ensure certificates work on older smartphones, operating systems, and devices that no longer receive software updates, Cloudflare plans to acquire an established root certificate. A root certificate is what tells browsers and devices whether to trust a CA. Acquiring one means websites using Cloudflare-issued certificates will be recognized immediately, including on legacy hardware. Cloudflare has also applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs, following the public process established by each. Together, the acquired root and the pending root program applications are designed to give Cloudflare-issued certificates broad recognition across the web as quickly as possible. Building on a successful experiment with Chrome, Cloudflare will also begin issuing production MTCs designed around built-in transparency, paving the way for post-quantum security without sacrificing web speed or performance, all from a new, single CA.

In 2014, Cloudflare launched Universal SSL and instantly doubled the amount of encrypted traffic on the web overnight by offering free TLS certificates to millions of websites. Today, the vast majority of the encrypted web relies on automated, free certificates. However, much of this burden rests on a small set of dominant issuers. Cloudflare’s new public CA will add an independent, high-scale issuer to that foundation.

Unlike traditional certificate authorities, Cloudflare is redesigning public certificate issuance from the ground up for modern scale and speed to provide:

Glass-Box Operational Transparency: Moving beyond traditional static audits, Cloudflare will share detailed operational and technical insights, publish reproducible code builds, and maintain a live, public health dashboard so the Internet community can inspect operations in real time.
Zero-Downtime Incident Response: By leveraging automated renewal signaling (RFC 9773), Cloudflare will be able to seamlessly trigger background certificate replacements across millions of sites instantly, minimizing the risk of mass web outages during routine revocations or security updates.
Scalable post-quantum security: Co-authored by Cloudflare as an IETF draft specification, MTCs verify that a certificate is logged in a trusted registry using lightweight proofs, avoiding the need to transmit heavy post-quantum signatures with every connection.
Frictionless Web Migration: Site owners will be able to manage both classic TLS certificates and next-generation Merkle Tree Certificates within a single, unified system, enabling a smooth transition to post-quantum security without forcing immediate cutovers.

Cloudflare will begin issuing classical certificates following completion of the browser root program application and acceptance process, with production MTC issuance scheduled to begin in the first quarter of 2027. Cloudflare’s acquisition of publicly trusted Root CA key material from GlobalSign is expected to close in the next two months and is subject to customary closing conditions. Site owners and developers can follow engineering updates and sign up for early access notifications via Cloudflare’s blog.

To learn more, please check out the resources below:

About Cloudflare

Cloudflare, Inc. (NYSE:NET) is the leading connectivity cloud company. It empowers organizations to make their employees, applications and networks faster and more secure everywhere, while reducing complexity and cost. Cloudflare’s connectivity cloud delivers the most full-featured, unified platform of cloud-native products and developer tools, so any organization can gain the control they need to work, develop, and accelerate their business.

Powered by one of the world’s largest and most interconnected networks, Cloudflare blocks billions of threats online for its customers every day. It is trusted by millions of organizations – from the largest brands to entrepreneurs and small businesses to nonprofits, humanitarian groups, and governments across the globe.

Learn more about Cloudflare’s connectivity cloud at cloudflare.com/connectivity-cloud. Learn more about the latest Internet trends and insights at https://radar.cloudflare.com.

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended, which statements involve substantial risks and uncertainties. In some cases, you can identify forward-looking statements because they contain words such as "may," "will," "should," "expects," "explores," "plans," "anticipates," "could," "intends," "targets," "projects," "contemplates," "believes," "estimates," "predicts," "potential," or "continues," or the negative of these words, or other similar terms or expressions that concern Cloudflare’s expectations, strategy, plans, or intentions. However, not all forward-looking statements contain these identifying words. Forward-looking statements expressed or implied in this press release include, but are not limited to, statements regarding the capabilities and effectiveness of Cloudflare’s public Certificate Authority and Cloudflare’s other products and technology, the benefits to Cloudflare’s customers from using Cloudflare’s public Certificate Authority and Cloudflare’s other products and technology, the timing of when Cloudflare’s public Certificate Authority or any of its related features will be generally available to all current and potential Cloudflare customers, Cloudflare’s technological development, future operations, growth, initiatives, or strategies, and comments made by Cloudflare’s Chief Executive Officer and others. Actual results could differ materially from those stated or implied in forward-looking statements due to a number of factors, including but not limited to, risks detailed in Cloudflare’s filings with the Securities and Exchange Commission (SEC), including Cloudflare’s Quarterly Report on Form 10-Q filed on August 6, 2026, as well as other filings that Cloudflare may make from time to time with the SEC.

The forward-looking statements made in this press release relate only to events as of the date on which the statements are made. Cloudflare undertakes no obligation to update any forward-looking statements made in this press release to reflect events or circumstances after the date of this press release or to reflect new information or the occurrence of unanticipated events, except as required by law. Cloudflare may not actually achieve the plans, intentions, or expectations disclosed in Cloudflare’s forward-looking statements, and you should not place undue reliance on Cloudflare’s forward-looking statements.

©2026 Cloudflare, Inc. All rights reserved. Cloudflare, the Cloudflare logo, and other Cloudflare marks are trademarks and/or registered trademarks of Cloudflare, Inc. in the U.S. and other jurisdictions. All other marks and names referenced herein may be trademarks of their respective owners.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260929852670/en/

Cloudflare, Inc.

Daniella Vallurupalli

Vice President, Head of Global Communications

press@cloudflare.com