Recommended Free Tools
Cloudflare plans to become a public certificate authority (CA), but its new service is not issuing certificates yet. Announced on September 29, 2026, the proposal would add another issuer alongside services such as Let’s Encrypt, with a longer-term plan to offer post-quantum Merkle Tree Certificates. Cloudflare has applied to four root programs and agreed to acquire a trusted root from GlobalSign; neither step by itself means the new CA is already broadly trusted or operational.
What did Cloudflare announce?
Cloudflare announced its intention to build a public CA: an organization that issues digital certificates browsers and other software can use to verify website identities and establish encrypted connections. The company said it had applied to the Chrome, Apple, Microsoft, and Mozilla root programs and signed a definitive agreement to acquire an established root from GlobalSign. It also stated plainly: “We are not issuing certificates yet, and it will be a little while before we do.” Cloudflare’s September 29 announcement describes these as steps toward a new issuer, not a completed launch.
As an Amazon Associate I earn from qualifying purchases.
A CA’s certificates are useful to the public only when clients trust the issuing chain. Root-program applications and a root acquisition agreement are therefore important milestones, but they do not establish that every program has accepted Cloudflare or that the transaction is complete. Cloudflare says the GlobalSign root is intended to help reach older phones, operating systems, and devices that no longer receive updates.
Is Cloudflare replacing Let’s Encrypt?
No replacement plan is established by the announcement. Cloudflare is proposing an additional public issuer; its current certificate products already use several CAs, including Let’s Encrypt, Google Trust Services, SSL.com, and Sectigo. Which CA is available depends on the certificate product and offering, according to Cloudflare’s certificate documentation.
#1 Best Overall
Cloudflare’s stated case for another issuer is resilience and operational diversity: it argues that much automated free certificate issuance depends on a relatively small group of providers. That is the company’s rationale, not an independently measured market-share finding. Whether its proposed CA becomes a meaningful alternative will depend on trust-store acceptance, operational performance, and how the service works once it is issuing.
How does this differ from Cloudflare’s existing free SSL?
Cloudflare already offers Universal SSL to eligible domains added to and activated on its platform. Its documentation says the service issues and renews free, publicly trusted, unshared, domain-validated certificates. It is managed SSL for sites using Cloudflare, not the new public CA announced in 2026. Universal SSL documentation says a full setup covers the root domain and first-level subdomains; a partial CNAME setup issues a certificate for each proxied subdomain.
The announced public CA is a separate effort to issue certificates as a public provider. Cloudflare has not yet begun that issuance, so there is no new CA service to select or compare in practice.
How will Cloudflare try to earn broad trust?
Cloudflare is pursuing two routes: acquiring already trusted root material and applying for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs. The company says the GlobalSign root is intended to improve compatibility with older devices. Acceptance and compatibility are not guaranteed simply by announcing applications or signing an acquisition agreement.
Rank #3
For context, Cloudflare’s documentation notes that some older Android and Java clients may not trust the applicable Let’s Encrypt ISRG Root X1 chain. It also says Google Trust Services cross-signs with a GlobalSign root installed on client devices for more than 20 years. These are vendor documentation statements, not a guarantee for any particular device; check the device and software vendor’s current trust information before relying on a certificate chain for legacy clients. Cloudflare’s edge certificate documentation discusses its certificate options and compatibility caveats.
What are Merkle Tree Certificates?
Merkle Tree Certificates (MTCs) are Cloudflare’s proposed approach to post-quantum website certificates. Rather than sending a large post-quantum signature with every connection, the design uses lightweight proofs tied to a trusted registry. The aim is to make post-quantum authentication more practical for web connections while preserving a way to check that a certificate is valid.
Rank #4
- 2-part carbonless unit set
- Consecutive numbering
- Includes Gift Certificates Available sign
- 25 certificates with envelopes per package
- White/canary form sequence
Cloudflare says it plans to issue conventional certificates and MTCs through one CA, with standard MTC issuance at no cost. Its stated target is production MTC issuance in early 2027, intended for inclusion in Chrome’s quantum-resistant root store. That is a target, not a guaranteed launch date or evidence that browsers currently accept MTCs. The technical details and plan are described in Cloudflare’s MTC engineering article.
Why does certificate transparency matter?
Public certificate transparency (CT) logs let others inspect records of issued certificates. Cloudflare’s engineering article says each certificate must be submitted to at least two public CT logs, and describes its Nimbus log family and planned Raio static log family. It estimates that post-quantum signatures could make CT logs store 40 times as much data. That 40× figure is Cloudflare’s projection, not an independently established measurement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What features are planned, and what remains unproven?
Cloudflare says the CA is being designed for public operational visibility, including detailed technical and operational insights, reproducible code builds, and a public health dashboard. It also describes automated renewal signaling under RFC 9773, intended to trigger background certificate replacement for routine updates or incidents. These are planned capabilities; there is not yet an operating CA on which to assess their availability or effectiveness.
- Announced: intent to build a public CA and applications to four root programs.
- In progress: a definitive agreement to acquire a GlobalSign root; the announcement does not establish that the acquisition is complete.
- Targeted: production MTC issuance in early 2027, according to Cloudflare.
- Not demonstrated yet: broad trust-store acceptance, live issuance and renewal, performance, or real-world adoption for the new CA.
How should website owners compare it with existing options?
| Question | Cloudflare’s announced public CA | Existing options described in the sources |
|---|---|---|
| Can you use it now? | No. Cloudflare said it was not issuing certificates at announcement. | Cloudflare documents existing certificate products and CA partners, including Let’s Encrypt; availability varies by product. |
| Who can use it? | Intended as a public CA; specific enrollment and certificate controls are not established in the announcement. | Universal SSL is managed for domains added to and activated on Cloudflare; its certificates are domain validated. |
| Trust and older clients | Cloudflare is pursuing a GlobalSign root acquisition and four root-program applications; broad acceptance is not confirmed. | Compatibility depends on the CA chain and client. Cloudflare documents specific legacy-client caveats for Let’s Encrypt and a GlobalSign cross-signing path for Google Trust Services. |
| Post-quantum certificates | Cloudflare plans MTC issuance, targeting early 2027; standard issuance is claimed to be free. | The cited sources do not establish equivalent MTC support for the other listed providers. |
For a site owner, the practical choice today remains among currently available certificate products, not Cloudflare’s announced CA. Once the new issuer is operating, compare its supported certificate types, enrollment and renewal process, chain compatibility for your audience, and transparency information against your actual requirements. For older clients in particular, verify the exact trust chain rather than assuming that a familiar CA name guarantees compatibility.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
