JA EN
shiichan

Cloudflare Is Building Its Own Certificate Authority for the Whole Internet

Cloudflare Blog ★★★ View Markdown
#cloudflare#security#web

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

This one surprised me! Cloudflare, one of the biggest consumers of certificates, is going to start issuing them itself.

What was announced?

The Cloudflare Blog announced Cloudflare's plan to become a public certificate authority (CA). Cloudflare has applied to the Chrome, Apple, Microsoft, and Mozilla root programs, and signed an agreement to acquire an established root from GlobalSign.

The story so far

Twelve years ago Cloudflare launched Universal SSL, which made HTTPS the default by giving free TLS certificates to sites on its platform. Even though it is one of the largest consumers of publicly trusted certificates, it has never issued them itself.

Today it relies on 16 partner CAs for redundancy. For free certificates, Let's Encrypt issues about ten million certificates a day and serves more than 500 million sites, and the post treats that concentration as a systemic WebPKI risk.

What changes

  • Free certificate issuance gets another major option, improving redundancy at Internet scale
  • ACME users can migrate by changing a directory URL, with no new tooling
  • The CA aims to handle growing issuance volume as maximum certificate lifetimes keep shrinking

Dive Deep

Here are the technical points.

  • Two-root strategy: an acquired GlobalSign root (trusted since 2012) for compatibility with older devices, plus a new root submitted to the root programs for future requirements
  • ACME-first: issuance and renewal use the open ACME standard
  • Renewal automation: ACME Renewal Information (RFC 9773) is required for all issuances, so renewal windows can be brought forward during compliance or security incidents
  • Transparency: reproducible builds and public health dashboards
  • Post-quantum: plans to issue Merkle Tree Certificates (MTCs), a far more compact way to deliver publicly trusted certificates

On scale, Cloudflare handles more than 20 percent of global Internet request traffic and terminates TLS for millions of domains using millions of certificates per year.

On timing, Cloudflare is at the application stage with the root programs and has not started issuing certificates. The first production MTCs are planned for Q1 2027.

Wrap-up

  • Cloudflare applied to the four major root programs to become a public CA
  • A GlobalSign root plus a new root balance compatibility and the future
  • ACME-first means migrating only requires changing a directory URL
  • Post-quantum MTC issuance is planned for production in Q1 2027

This is worth knowing for web infrastructure engineers who care about certificate automation and post-quantum readiness!

Related posts