Cloudflare says it is applying to become a public certificate authority, a move that would put one of the largest TLS terminators on the internet into the certificate-issuance business as automation and shorter certificate lifetimes make the web’s trust layer more operationally demanding.
In a Birthday Week announcement, Cloudflare said it has applied for inclusion in the Chrome, Apple, Microsoft and Mozilla root programs and has signed a definitive agreement to acquire an established, broadly trusted root from GlobalSign. The company says it is not issuing public certificates yet, but is laying out the milestones for a service intended to work through the Automated Certificate Management Environment, or ACME.
For hosting providers and site operators, the practical point is redundancy. Cloudflare notes that the free, automated certificate model now carries much of the encrypted web, and that heavy dependence on a small number of issuers can become a resilience problem during CA outages, revocation events or validation trouble. Cloudflare says it already provisions certificate packs for its own customers through multiple CAs and wants that failover mindset reflected in the CA it is building.
The announcement also previews stricter assumptions about automation. Cloudflare says it plans to require support for ACME Renewal Information, standardized in RFC 9773, so subscribers can be moved to replacement certificates on a timeline controlled by renewal signals rather than emergency manual work. That is the part hosting teams should read twice: certificate management is becoming less like an annual admin task and more like routine infrastructure plumbing.
There is also a post-quantum angle. Cloudflare says it plans to be among the first CAs to issue production Merkle Tree Certificates in the first quarter of 2027, while still supporting classic WebPKI certificates. In a related Cloudflare post this week, the company added per-domain visibility into post-quantum TLS key exchange in HTTP Analytics, Log Explorer and Logpush, underscoring that certificate format, TLS telemetry and origin compatibility are converging into one operational checklist.
The near-term takeaway is not that site owners should switch certificate vendors today. They cannot. It is that certificate issuance is becoming a reliability market in its own right. Hosts, agencies and SaaS platforms should make sure their stacks can rotate issuers, use ACME cleanly, monitor renewal failures and understand which parts of their edge-to-origin path are ready for shorter lifetimes and post-quantum transition work.
Source: Cloudflare: “Building a certificate authority for the whole Internet”. Related Cloudflare background: post-quantum certificate authority and Merkle Tree Certificates; post-quantum TLS visibility for domains.