Cloudflare wants to issue the certificates it has long depended on

Cloudflare announced its intention to become a public certificate authority on 29 September. It had applied to browser and operating-system root programmes and signed an agreement to acquire an established GlobalSign root. The company explicitly said it was not yet issuing certificates. These are steps toward becoming an issuer, rather than an announcement that a universally trusted service was already live.

A newly accepted root takes time to reach devices through software updates. Some older devices never receive those updates. Cloudflare’s plan therefore has two tracks: an established root for compatibility and new roots designed around future programme requirements. Its announcement also proposes automated issuance and renewal using ACME. The practical opportunity is another automated certificate supplier; the operational challenge is earning and maintaining trust across different client populations.

Cloudflare separately described plans for Merkle Tree Certificates, targeting early 2027 inclusion in Chrome’s quantum-resistant root ecosystem. Larger post-quantum signatures put pressure on the traditional certificate-chain approach. MTCs instead place certificate entries in an append-only tree and use inclusion proofs against signed checkpoints. Transparency becomes part of issuance itself. Cloudflare plans standard MTC issuance without charge and an issuance stack that can serve conventional certificates during the transition.

The two announcements connect a business expansion with a technical migration, but the dependencies are different. Public trust requires root-programme processes and client support. The MTC path also requires interoperable software, logs and cosigners. Cloudflare’s proposed design uses independent cosigning to help expose inconsistent log views. Our reading is that compatibility and renewal operations will be as consequential as the cryptographic format. A credible launch must work for both the browsers gaining new capabilities and the devices that will retain older trust stores. That combination explains why the company is pursuing existing and future trust infrastructure together.