PRESS RELEASE
San Francisco, CA, Sept. 29, 2026 – Cloudflare, Inc. (NYSE: NET), the leading connectivity cloud company, today announced its intent to become a public Certificate Authority (CA), an open service that issues the digital certificates websites need to encrypt traffic and prove their identity to visitors. The new CA will support both traditional encryption and next-generation post-quantum Merkle Tree Certificates (MTCs), giving every website a path to stay protected as computing power advances—with no new tools or rebuilds required. Additionally, Cloudflare has agreed to acquire established, publicly trusted Root CA key material from GlobalSign, which will provide ubiquity across the global Web PKI ecosystem.
Every secure website depends on a certificate authority to verify its identity and enable encrypted connections. Today, that trust is concentrated in a small number of dominant issuers, creating systemic risk if any one of them fails or is compromised. At the same time, most certificate infrastructure was built before quantum computing became a practical concern. Quantum computers capable of breaking today's encryption are expected within years, and much of the web is not prepared for that shift.
"Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we're taking the next step by building an open, transparent and reliable Certificate Authority for the entire Internet," said Matthew Prince, CEO and co-founder of Cloudflare. "Upgrading the web's security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet. By balancing support for older devices with brand-new, post-quantum tech, we're providing a permanent safety net—so the Internet stays fast, reliable, and secure for all devices, no matter what comes next."
To ensure certificates work on older smartphones, operating systems, and devices that no longer receive software updates, Cloudflare plans to acquire an established root certificate. A root certificate is what tells browsers and devices whether to trust a CA. Acquiring one means websites using Cloudflare-issued certificates will be recognized immediately, including on legacy hardware. Cloudflare has also applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs, following the public process established by each. Together, the acquired root and the pending root program applications are designed to give Cloudflare-issued certificates broad recognition across the web as quickly as possible. Building on a successful experiment with Chrome, Cloudflare will also begin issuing production MTCs designed around built-in transparency, paving the way for post-quantum security without sacrificing web speed or performance, all from a new, single CA.