--- title: "Building a post-quantum certificate authority with Merkle Tree Certificates" description: "The Web PKI faces a scaling problem because post-quantum (PQ) signatures are roughly 40 times larger than classical ones, making direct adoption at Internet scale expensive. Merkle Tree Certificates (MTCs) address this by batching certificates into an append-only Merkle tree, allowing a CA to sign the tree root and clients to verify with a compact inclusion proof. Cloudflare is building a certificate authority that will support MTC issuance, targeting early 2027 for inclusion in Chrome’s new Quantum-resistant Root Store, and will offer standard MTC issuance at no cost. The MTC architecture couples issuance with logging (“issue by logging”), making transparency a first-party property rather than an add-on, which reduces redundancy and scaling overhead. Cloudflare successfully completed an experimental deployment with Chrome and is now moving to full production, but notes that broader ecosystem participation from browsers, CAs, and monitors is needed for the transition." --- # Building a post-quantum certificate authority with Merkle Tree Certificates [Cloudflare](https://yomu.fyi/company/cloudflare) · Mari Galicer · Sep 29, 2026 **Type:** Announcement ## Summary The Web PKI faces a scaling problem because post-quantum (PQ) signatures are roughly 40 times larger than classical ones, making direct adoption at Internet scale expensive. Merkle Tree Certificates (MTCs) address this by batching certificates into an append-only Merkle tree, allowing a CA to sign the tree root and clients to verify with a compact inclusion proof. Cloudflare is building a certificate authority that will support MTC issuance, targeting early 2027 for inclusion in Chrome’s new Quantum-resistant Root Store, and will offer standard MTC issuance at no cost. The MTC architecture couples issuance with logging (“issue by logging”), making transparency a first-party property rather than an add-on, which reduces redundancy and scaling overhead. Cloudflare successfully completed an experimental deployment with Chrome and is now moving to full production, but notes that broader ecosystem participation from browsers, CAs, and monitors is needed for the transition. ## Context The Web PKI’s current certificate infrastructure cannot efficiently handle the 40x larger signatures required by post-quantum cryptography. Merkle Tree Certificates (MTCs) provide a solution by batching certificates into an append-only Merkle tree, where the CA signs only the tree root and clients verify with compact inclusion proofs. Cloudflare is building a new certificate authority that will issue MTCs, targeting early 2027 for inclusion in Chrome’s Quantum-resistant Root Store. The CA will offer standard MTC issuance at no cost. Cloudflare previously ran a successful experimental deployment with Chrome and is now moving toward production, but the transition requires ecosystem-wide participation from browsers, CAs, mirrors, and monitors. ## Approach / What changed Cloudflare’s CA implements Merkle Tree Certificates (MTCs) as defined by the IETF PLANTS working group. Instead of signing individual certificates, the CA batches certificates into an append-only Merkle tree and signs the tree root. Clients verify a certificate using a compact inclusion proof—a sequence of cryptographic hashes—against a signed tree head. This couples issuance with logging (‘issue by logging’), making transparency a requirement for operation rather than an add-on. The CA also operates mirroring cosigners that store copies of issuance logs, verifying append-only consistency and ensuring log availability. Certificates can be issued in standalone form (with inclusion proof in certificate) or landmark-relative form (using out-of-band tree heads). ## Takeaways - PQ signatures are roughly 40 times larger than classical ones, ballooning CT log storage needs by 40x and making direct adoption at Internet scale expensive. - MTCs reduce per-certificate overhead by batching certificates into a Merkle tree, allowing verification via compact inclusion proofs instead of individual PQ signatures. - Cloudflare’s CA will issue MTCs at no cost, targeting early 2027 for Chrome’s root store, but ecosystem participation from multiple CAs, browsers, and monitors is needed. ## FAQ ### How do MTCs reduce certificate size? MTCs batch many certificates into an append-only Merkle tree. The CA signs only the tree root, and clients verify a certificate using a compact inclusion proof—a sequence of hashes—instead of a full individual signature. This drastically reduces size overhead compared to using individual PQ signatures. ### What does 'issue by logging' mean? In the MTC ecosystem, issuance and logging are coupled: a certificate is issued by being included in the CA's Merkle tree log, and the inclusion proof serves as the trust anchor. This makes transparency a first-class property of issuance rather than a separate compliance step. ### When will Cloudflare's CA support MTCs? Cloudflare's new CA will support MTC issuance targeting early 2027 for inclusion in Chrome's newly launched Quantum-resistant Root Store. The CA will offer standard MTC issuance at no cost. **Tags:** [Certificate Transparency](https://yomu.fyi/topic/certificate-transparency), [Post-Quantum Cryptography](https://yomu.fyi/topic/post-quantum), [Security](https://yomu.fyi/topic/security), [TLS](https://yomu.fyi/topic/tls) - Source: [Cloudflare](https://blog.cloudflare.com/pq-ca-with-mtcs) - Source URL: https://blog.cloudflare.com/pq-ca-with-mtcs - Ingested by Yomu: 2026-09-29T15:00:14.120Z [Read original post](https://blog.cloudflare.com/pq-ca-with-mtcs)