Cloudflare Plans a Free Public CA: ARI Required, MTCs From 2027

What Cloudflare has announced #

Cloudflare has announced its intent to become a public certificate authority (CA), with three concrete milestones: applications for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs, a definitive agreement to acquire an established root from GlobalSign, and plans to serve post-quantum certificates. Cloudflare is not issuing certificates yet. The post states it plainly:

We are not issuing certificates yet, and it will be a little while before we do.

Building a certificate authority for the whole Internet

The two roots serve different purposes. A newly created root must first be accepted by root programs and then propagate to operating systems and browsers, and the post notes it never reaches devices that have stopped receiving updates. The acquired GlobalSign root, which the post says has been trusted across browsers, operating systems, and devices since 2012, is meant to give coverage from the start. The new root is for root programs whose policies cap how old a trusted root may be.

The CA announcement explains the motive: if the dominant free certificate authority "had a bad week, much of the web would have no comparable free, automated alternative ready to take the load." Every Cloudflare Universal SSL certificate already ships with a backup certificate from another CA.

How to get certificates: ACME and renewal automation #

Issuance will be ACME-first, so moving from an existing free CA means changing a directory URL, with no new tooling according to the post. Renewal is also a condition of issuance: Cloudflare will only issue to clients that support ACME Renewal Information (ARI), standardized in RFC 9773. Subscribers must poll the renewal endpoint, act on the published renewal windows, and identify the certificate being replaced.

The post ties this to revocation planning. When certificates must be retired, Cloudflare says it can bring forward renewal windows, spread replacements across the available time, and track replacement issuance. Transparency commitments include reproducible builds of the signing software, attestation of the hardware security modules holding its keys, and a public dashboard for issuance health and incidents.

Merkle Tree Certificates and the post-quantum plan #

Cloudflare plans to be one of the first CAs to issue production Merkle Tree Certificates (MTCs), with the first certificates targeted for the first quarter of 2027. The post describes MTCs as a more compact way to deliver publicly trusted certificates, designed for a post-quantum world where traditional chains grow large enough to strain TLS handshakes. It also states that Chrome named MTCs as the preferred path for post-quantum authentication.

Classic certificates and MTCs will be issued under one CA with one lifecycle, so customers do not have to choose a side or run two systems. The post expects classic certificates to remain in use for many years, with MTCs taking a growing share of issuance. Cloudflare also says it plans to be one of the first CAs to serve post-quantum certificates, targeting Chrome's Quantum-resistant Root Program.

CryptoLabe maps cryptography for the 2029 deadline #

A separate post describes the migration work behind this. Cloudflare is racing toward a 2029 target deadline for full post-quantum readiness, and the post says many products already use post-quantum encryption, while post-quantum authentication is still early. The source states CryptoLabe is internal and not available to customers. Using AI to chart a course for our post-quantum migration describes a two-stage scan, discovery and then analysis, that assigns each finding one of these classifications:

• Classical encryption: ECDHE, RSA key agreement, or other public-key encryption such as HPKE.
• Classical signature: RSA or ECDSA signatures in certificates, TLS, or other handshakes.
• Classical token: RS256 or ES256 JWTs, which RFC 9964 replaces with ML-DSA.
• PQ-ready hybrid key exchange: X25519MLKEM768 in TLS 1.3.
• PQ-ready: other post-quantum uses, such as ML-DSA.

When evidence is insufficient, the model assigns More evidence needed, External dependency, or Unknown instead of guessing. The post also notes there is no ground-truth dataset yet for comparing prompt versions.

Why it matters #

The CA plan and the CryptoLabe work address the same dependency: the certificates and key exchanges that TLS relies on. The CA post notes that Cloudflare terminates TLS for millions of domains and expects the number of certificates it relies on to grow. The CryptoLabe post explains that cryptography often hides in shared libraries, configuration files, and protocol defaults, so a grep for algorithm names both overcounts and undercounts. The CryptoLabe post nevertheless says that "an exhaustive cryptographic inventory is not a prerequisite for action": most organizations should first protect traffic in bulk, then identify the systems whose compromise would matter most, discover their cryptography and migrate it in priority order, starting with the repository of one important system.

Who is affected #

Teams that obtain certificates through ACME tooling will need to check that their clients support ARI before pointing them at Cloudflare's directory, since the post makes ARI support a condition of issuance. Operators who run their own renewal automation should confirm it polls the renewal endpoint and identifies the certificate it replaces. CryptoLabe itself stays internal, so teams planning their own post-quantum migration get the post's published prompts and its priority-order approach rather than the tool. Cloudflare offers a registration page for updates on the CA work.