Cloudflare Plans Quantum-Safe TLS Certificates

Cloudflare quantum-safe TLS certificates are moving from a research curiosity to a public engineering commitment. The internet infrastructure provider said it plans to issue certificates built to resist attacks from quantum computers, a step that would make it one of the first authorities anywhere to do so at scale. The company is not shipping them today. It is promising, in public, to build the machinery that gets there.

The Promise, and the Long Wait

The certificates rely on cryptography. It's widely believed to survive quantum attacks. And the plan calls for an open source platform that issues both classic TLS certificates and a post-quantum equivalent known as Merkle Tree Certificates, which they're pairing together. The hybrid certificates cost nothing. They're free for paying customers and free users alike.

To make the system real and to spread it across the sprawling TLS ecosystem, Cloudflare will acquire an already trusted certificate root from CA GlobalSign. That purchase matters more than it might sound. Trust in the certificate world is inherited, not declared. A root that browsers already accept gives Cloudflare a running start.

The company says the move will let millions of websites adopt post-quantum certificates at the flip of a switch, with no added performance overhead. That last part is the hard part.

Why You Cannot Just Swap Algorithms

Here is the trap most people miss. Quantum-proof versions of today's classical X.509 certificates would add roughly 40 times the data required for a TLS handshake, the exchange that happens every time a browser or app opens a new session with a server. Multiply that by every connection on the internet and the bandwidth and computation demands would break the web as we know it.

So the fix is not a bigger lock. It is a different kind of proof.

In February, Google announced a solution built on Merkle Trees. These hierarchical data structures use cryptographic hashes and other math to verify huge amounts of information using only a small fraction of it, which is a clever trick when you think about how much data flows across the internet every single day.

Google and Cloudflare have been testing the design in limited pilot programs. It drops handshake data to about 40 kilobytes. That's roughly what's processed today. And they're not done yet.

From Signature Chains to Tree Heads

Today's WebPKI relies on a multi-link chain of signatures. Quantum computers could forge it. Replacing every link with a quantum-resistant signature is resource-prohibitive, and because it's resource-prohibitive, and because we've got no practical way to pay that cost across every link in the chain, the chains get replaced with compact Merkle Tree proofs instead. So they're swapped out.

A certificate authority signs just one tree head. That's it. And that single signature can stand in for millions of certificates, which means the trust you place in a browser session often rests on something far smaller than you'd think. Most of the time, what a browser handles is a landmark, a lightweight proof that the certificate sits somewhere in the tree.

"By coupling issuance and logging, transparency becomes a requirement for operation, rather than an add-on," Cloudflare engineer Mari Galicer said.

That coupling? It's a real structural shift. Under the current system, transparency logs are a process that stays separate from certificate issuance, and that separation is just how things work right now. With Merkle Tree Certificates, logging becomes part of issuance itself. And that's the change.

The DigiNotar Ghost in the Room

Transparency logs exist for a reason. Industry rules require that TLS certificates be published in append-only distributed ledgers, and website owners check those logs in real time to catch rogue certificates issued for their domains. The programs were born from the 2011 hack of Netherlands-based DigiNotar, which allowed the minting of 500 counterfeit certificates for Google and other sites. Some were used to spy on web users in Iran.

Quantum computing threatens that watchdog role directly. It's a real danger. Once viable, Shor's algorithm could forge classical encryption signatures along with the public keys of certificate logs, which means the trust framework we've relied on for years would face a serious test. An attacker could then forge signed certificate timestamps, the proof a browser or operating system uses to confirm a certificate was registered when it never was. And we can't stop that.

The danger is not only forged certificates. It is forged evidence about certificates.

What Cloudflare Is Actually Building

The plan includes more than Merkle Trees. Cloudflare points to the Automated Certificate Management Environment, or ACME, an open source mechanism for issuing certificates and renewing them continuously shortly before they expire, which is a lot to pack into one acronym. But there's more. The quantum-resistant certificates will also carry a way to send signatures out-of-band, for instance through a browser update, if a downed server or other technical problem blocks a landmark update, and that's the part people don't always catch. It's a backup path. We've got options here.

• Hybrid classic and post-quantum certificates, free to all users
• Merkle Tree Certificates built on an open source issuance platform
• A trusted root acquired from CA GlobalSign
• Out-of-band signature delivery as a fallback path

Cloudflare is careful to set expectations. "We are not issuing certificates yet, and it will be a little while before we do," Cloudflare's Steve Goldsmith wrote. "What we are doing is committing to the work in public, sharing the milestones as they land, and telling you exactly what we are building while working with the root programs and other members of the WebPKI community to achieve this."

A Years-Long Rewrite of Web Trust

None of this happens quickly. The overhaul touches operating systems, browsers, certificate authorities, and internet infrastructure, and it requires the work of an untold number of engineers. Cloudflare expects to start issuing certificates in the first quarter of 2027.

Until then, the significance of Cloudflare quantum-safe TLS certificates lies less in what they do today and more in what they commit the web to doing. The company is betting big. It's a simple wager. The post-quantum transition won't be won by whoever swaps in the cleverest algorithm, because algorithms are easy to copy and hard to trust, and trust is the thing that actually keeps every connection alive when nobody's watching the math. It will be won by whoever rebuilds the trust layer underneath everyone else's connections. That's a years-long project. And it has now been announced in public, with milestones attached.

Frequently Asked Questions

What are Cloudflare quantum-safe TLS certificates and what does Cloudflare plan to build?

Cloudflare quantum-safe TLS certificates are certificates built to resist attacks from quantum computers, and the company plans to issue them at scale. The plan calls for an open source platform that issues both classic TLS certificates and a post-quantum equivalent known as Merkle Tree Certificates, paired together as hybrid certificates that are free for paying customers and free users alike.

Why can't current classical X.509 certificates simply be swapped for quantum-proof versions?

Quantum-proof versions of today's classical X.509 certificates would add roughly 40 times the data required for a TLS handshake, and multiplying that by every connection on the internet would break the web as we know it. Replacing every link in the WebPKI signature chain with a quantum-resistant signature is resource-prohibitive, so the chains get replaced with compact Merkle Tree proofs instead.

How do Merkle Tree Certificates change the way trust and transparency work in the certificate system?

A certificate authority signs just one tree head, and that single signature can stand in for millions of certificates, with browsers usually handling a lightweight landmark proof that the certificate sits somewhere in the tree. With Merkle Tree Certificates, logging becomes part of issuance itself, so transparency becomes a requirement for operation rather than an add-on.

When does Cloudflare expect to start issuing these certificates, and what must happen before then?

Cloudflare expects to start issuing certificates in the first quarter of 2027, and it is careful to say it is not issuing certificates yet and it will be a little while before it does. The overhaul touches operating systems, browsers, certificate authorities, and internet infrastructure, and it requires the work of an untold number of engineers.

What role does the acquisition of a trusted certificate root from CA GlobalSign play in the plan?

Trust in the certificate world is inherited, not declared, so a root that browsers already accept gives Cloudflare a running start. The company says the move will let millions of websites adopt post-quantum certificates at the flip of a switch, with no added performance overhead.