On September 29, 2026, Cloudflare announced plans to operate a public certificate authority (CA) for conventional TLS certificates and post-quantum Merkle Tree Certificates (MTCs). Cloudflare said certificate issuance had not begun as of that announcement and is targeting early 2027 for production MTCs.
Cloudflare plans one authority for two certificate formats
Cloudflare plans to issue conventional certificates and MTCs under one CA, with a shared lifecycle and set of guarantees. The company says this approach is intended to support a gradual transition rather than require an immediate switch across the web.
Cloudflare also said it had signed a definitive agreement to acquire an established certificate root from GlobalSign and applied for inclusion in the root programs of Chrome, Apple, Microsoft, and Mozilla.
How Merkle Tree Certificates work
Cloudflare’s MTC design ties certificate issuance to an append-only Merkle tree, a structure that records entries so later changes can be detected. A signed tree head represents the log’s state, while an inclusion proof lets a client check that a particular certificate is in that tree.
Certificate transparency logging is generally separate from issuing a certificate. In Cloudflare’s planned MTC approach, logging is part of the issuance process. The proof can provide a compact way to establish a certificate’s place in the log without sending a conventional chain of signatures in every case.
Cloudflare says its planned CA will prioritize ACME, the Automatic Certificate Management Environment protocol used to automate certificate requests and renewals. It also says subscribers using MTCs will need to support ACME Renewal Information (ARI), standardized in RFC 9773.
What Cloudflare’s Chrome experiment measured
In a technical post published September 29, 2026, Cloudflare reported that landmark MTC handshakes in its Chrome experiment were 9% faster at the median than a control using a classical signature chain. Cloudflare attributed most of the improvement to omitting intermediate certificates.
The experiment used classical signatures, not post-quantum signatures. Its speed result therefore describes that experiment, not the performance of production MTCs using post-quantum signatures.
Cloudflare targets early 2027 for MTC issuance
Cloudflare is targeting early 2027 to begin production MTC issuance and says standard MTC issuance will be free. Both are plans for the future service; the company said on September 29, 2026, that its certificate issuance had not yet begun.
