Cloudflare to Issue Quantum-Safe TLS Certificates

Cloudflare quantum-safe TLS certificates are now officially on the roadmap. The internet infrastructure giant confirmed it plans to become one of the first authorities to issue them. It's a big deal. The company said Tuesday it will use an open source platform capable of issuing both classic TLS certificates and a post-quantum equivalent known as Merkle Tree Certificates, which is a technical mouthful but a serious step toward protecting encrypted traffic from future quantum computers that could otherwise crack today's cryptography. And the hybrid certificates will be free to both paying and non-paying users. They're not charging extra.

This is not a finished product. It is a commitment, made loudly and in public, to rebuild a piece of the web's plumbing that most people never think about until it breaks.

A Free Certificate With a Long Runway

Cloudflare's approach leans on an open source platform that produces two things at once: the conventional TLS certificates websites rely on today, and the post-quantum version designed to survive an era of quantum computing. Hybrid issuance matters because it avoids a hard cutover. Sites can keep speaking the old language while quietly carrying the new one alongside it.

Cloudflare won't build this from scratch. To build the system at scale, Cloudflare will acquire an already trusted certificate root from CA GlobalSign, and that purchase is the shortcut to ubiquity. A trusted root is what browsers recognize. Without one, no amount of clever cryptography gets a certificate accepted by the wider web. But with it, Cloudflare says millions of websites will be able to adopt post-quantum certificates at the flip of a switch, with no added performance overhead, and they're saying it's that simple.

There is a catch, and the company is upfront about it.

“We are not issuing certificates yet, and it will be a little while before we do,” Cloudflare's Steve Goldsmith wrote. “What we are doing is committing to the work in public, sharing the milestones as they land, and telling you exactly what we are building while working with the root programs and other members of the WebPKI community to achieve this.”

The expected start date for issuance is the first quarter of 2027. That's a long runway. And it's a long runway for a company that could have simply announced a launch, which is a fact we've got to sit with, because they don't have to wait this long, and they can't pretend the calendar isn't telling its own story here.

Why You Cannot Just Swap Algorithms

The obvious fix for quantum threats would be to take today's classical X.509 certificates and replace the vulnerable signatures with quantum-proof ones. That plan collapses under its own weight. Quantum-safe versions of those certificates would add roughly 40 times the data required for a TLS handshake, the exchange that happens every time a browser or application opens a new session with a server.

Forty times the handshake data. Multiply that across the entire internet.

It would break the web as we know it. The computation and bandwidth costs, when you stack them up and push them through every server and every connection that keeps this whole system running, are simply too high. They're too high. We can't absorb that.

So the industry went looking for a different shape. In February, Google put forward a solution built on Merkle Trees, hierarchical data structures that use cryptographic hashes and other math to verify large amounts of information using only a small fraction of it. Google and Cloudflare have been testing the design in limited pilot programs. The result drops handshake data to about 40 kilobytes, roughly what is processed today.

From Signature Chains to Tree Proofs

A certificate's authenticity is proven through a multi-link chain of signatures. That chain is what quantum computers threaten. Shor's algorithm could eventually forge classical encryption signatures. It could forge the public keys of certificate logs too. An attacker who reached that point, armed with that capability and the patience to exploit it, could forge signed certificate timestamps, convincing a browser or operating system that a certificate had been registered when it never was. And that's the danger. We've got no easy fix.

Since replacing each signature in the chain with a quantum-resistant one is resource-prohibitive, the chain itself gets replaced. Merkle Tree proofs are compact. To complete one, a certificate authority signs only a single "tree head" that can stand in for millions of certificates. In most cases, what a browser handles is a "landmark," a lightweight proof that a given certificate sits somewhere in the tree.

Important. The design does more than shrink data. It fuses two processes that have always been separate.

Industry rules require TLS certificates to be published in append-only distributed ledgers known as public transparency logs. Website owners watch those logs in real time to catch rogue certificates issued for their domains. Those programs exist because of the 2011 hack of Netherlands-based DigiNotar, which allowed the minting of 500 counterfeit certificates for Google and other sites, some of which were used to spy on web users in Iran.

Today, logging is distinct from issuance. With Merkle Tree Certificates, logging becomes a core part of issuance itself.

“By coupling issuance and logging, transparency becomes a requirement for operation, rather than an add-on,” Cloudflare engineer Mari Galicer said.

The Parts Still Being Assembled

Cloudflare's plan bundles in several supporting pieces:

• Automated Certificate Management Environment (ACME), an open source mechanism for issuing certificates and renewing them continuously shortly before expiration.
• An out-of-band mechanism for delivering signatures, for example through a browser update, if a downed server or other technical problem prevents a landmark update from arriving.
• Coordination with root programs and the broader WebPKI community, which Cloudflare says is necessary to reach ubiquity across the sprawling TLS ecosystem.

None of this is a simple algorithm swap. The overhaul touches operating systems, browsers, certificate authorities, and internet infrastructure, and it will take years to complete because it depends on engineers across all of those domains.

What Actually Changes for Website Owners

For most operators, the promise is modest. And it's welcome. Post-quantum certificates at the flip of a switch, free of charge, with no performance penalty, which is exactly the kind of practical deal that sounds simple until you ask who actually does the work. The heavy lifting happens behind the scenes. It's in certificate authorities, transparency logs, and browser code. They're the ones who can't flip anything.

The Timeline to Watch

Cloudflare quantum-safe TLS certificates will not appear tomorrow. The company expects to begin issuing them in the first quarter of 2027, and it says it will share milestones as they land. Until then, the work is public, deliberate, and unfinished by design.

Frequently Asked Questions

What are Cloudflare quantum-safe TLS certificates, and what technology will Cloudflare use to issue them?

Cloudflare quantum-safe TLS certificates are post-quantum certificates that Cloudflare plans to issue using an open source platform capable of producing both classic TLS certificates and a post-quantum equivalent known as Merkle Tree Certificates. The company confirmed it plans to become one of the first authorities to issue them.

Why can't today's classical X.509 certificates simply have their signatures swapped for quantum-proof ones?

Quantum-safe versions of those certificates would add roughly 40 times the data required for a TLS handshake, and multiplying that across the entire internet would break the web as we know it. The computation and bandwidth costs, pushed through every server and every connection, are simply too high to absorb.

How do Merkle Tree Certificates change the relationship between certificate issuance and transparency logging?

With Merkle Tree Certificates, logging becomes a core part of issuance itself rather than a separate step. According to Cloudflare engineer Mari Galicer, coupling issuance and logging makes transparency a requirement for operation rather than an add-on.

When does Cloudflare expect to begin issuing quantum-safe TLS certificates, and what has it said about the current status?

The expected start date for issuance is the first quarter of 2027. Cloudflare's Steve Goldsmith wrote that they are not issuing certificates yet and it will be a little while before they do, while committing to the work in public and sharing milestones as they land.

What will the change to post-quantum certificates actually mean for most website owners?

For most operators, the promise is modest but welcome: post-quantum certificates at the flip of a switch, free of charge, with no performance penalty. The heavy lifting happens behind the scenes in certificate authorities, transparency logs, and browser code.