---
title: "Building a certificate authority for the whole Internet"
description: "Cloudflare, which terminates TLS for millions of domains and sits in front of over 20% of global Internet request traffic, announced its intent to become a public certificate authority (CA) during Birthday Week 2026. The company has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and signed a definitive agreement to acquire an established root from GlobalSign. This acquisition ensures certificate compatibility with older clients that a fresh root would never reach, addressing the long tail of devices where avoidable breakage occurs. Cloudflare plans to be among the first CAs to issue production Merkle Tree Certificates (MTCs) in early 2027, targeting post-quantum readiness as part of Chrome’s Quantum-resistant Root Program. The CA will be ACME-first, require ACME Renewal Information (ARI) support for issuance, and operate transparently with reproducible builds of signing software and a public dashboard."
---

# Building a certificate authority for the whole Internet

[Cloudflare](https://yomu.fyi/company/cloudflare) · Steve Goldsmith · Sep 29, 2026

**Type:** Announcement

## Summary

Cloudflare, which terminates TLS for millions of domains and sits in front of over 20% of global Internet request traffic, announced its intent to become a public certificate authority (CA) during Birthday Week 2026. The company has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and signed a definitive agreement to acquire an established root from GlobalSign. This acquisition ensures certificate compatibility with older clients that a fresh root would never reach, addressing the long tail of devices where avoidable breakage occurs. Cloudflare plans to be among the first CAs to issue production Merkle Tree Certificates (MTCs) in early 2027, targeting post-quantum readiness as part of Chrome’s Quantum-resistant Root Program. The CA will be ACME-first, require ACME Renewal Information (ARI) support for issuance, and operate transparently with reproducible builds of signing software and a public dashboard.

## Context

Cloudflare has been a large consumer of publicly trusted certificates for over a decade, relying on multiple CAs for primary and backup paths. The company has experienced CA failures and wants to increase redundancy in the WebPKI ecosystem by becoming a CA itself.

## Approach / What changed

Acquiring an established root from GlobalSign for immediate device reach and submitting a new root for inclusion in root programs for future compatibility; building an ACME-first CA with mandatory ACME Renewal Information (ARI) support, transparent operations with reproducible builds and a public dashboard, and issuing Merkle Tree Certificates (MTCs) starting Q1 2027 for post-quantum readiness.

## Takeaways

- Cloudflare will acquire GlobalSign’s root, trusted since 2012, to ensure certificate compatibility with older clients on day one.
- The CA will require ACME Renewal Information (ARI) support for issuance, enabling automated renewal and revocation windows to limit incident impact.
- Cloudflare plans to issue Merkle Tree Certificates (MTCs) starting Q1 2027, targeting post-quantum readiness and Chrome’s Quantum-resistant Root Program.

## FAQ

### When will Cloudflare start issuing certificates?

Not yet; Cloudflare is working through root program approvals and expects first Merkle Tree Certificates (MTCs) in early 2027.

### How will Cloudflare ensure certificate compatibility with older devices?

By acquiring GlobalSign's established root, trusted since 2012, which reaches older clients that a fresh root would never reach.

### Will Cloudflare's CA be free?

Yes, Cloudflare plans to offer free certificates via ACME, similar to Let's Encrypt but as a redundant alternative to reduce systemic risk.

**Tags:** [ACME](https://yomu.fyi/topic/acme), [Certificate Authority](https://yomu.fyi/topic/certificate-authority), [Cloudflare](https://yomu.fyi/topic/cloudflare), [Post-Quantum Cryptography](https://yomu.fyi/topic/post-quantum), [TLS](https://yomu.fyi/topic/tls)

- Source: [Cloudflare](https://blog.cloudflare.com/cloudflare-certificate-authority)
- Source URL: https://blog.cloudflare.com/cloudflare-certificate-authority
- Ingested by Yomu: 2026-09-29T15:00:16.149Z

[Read original post](https://blog.cloudflare.com/cloudflare-certificate-authority)