Free tools Windows power users keep installed
One-click scans. No signup required.
On September 29, 2026, Cloudflare announced that it intends to become a public certificate authority (CA). It plans to issue ordinary TLS certificates and a newer post-quantum type called Merkle Tree Certificates (MTCs). None of this is live yet. Browser root-program acceptance is pending, the GlobalSign deal had not closed at announcement, and production MTC issuance is scheduled for Q1 2027. The CA is not issuing certificates today.
What was announced
Cloudflare describes the service as an open public CA. It would issue the certificates websites use to encrypt traffic and prove their identity. The company says the design will include operational transparency, reproducible code builds and a public health dashboard. Those are announced commitments. They are not practices anyone has independently verified, because the CA has not finished its launch steps. (Cloudflare press release; a corroborating copy is on Cloudflare’s investor site.)
As an Amazon Associate I earn from qualifying purchases.
Cloudflare CEO Matthew Prince said: “Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we’re taking the next step by building an open, transparent and reliable Certificate Authority for the entire Internet.”
What a public certificate authority does
A public CA vouches that a certificate really belongs to the site presenting it. Browsers and operating systems decide which CAs to trust through root programs. A CA’s certificates only work for the general public once those programs accept its roots. That is why the status items below matter more than the announcement itself.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Status: what is done and what is pending
| Item | Status as announced (Sept 29, 2026) |
|---|---|
| Public CA service | Planned; not yet issuing |
| Root key material from GlobalSign | Agreed to acquire; transaction expected to close within two months, subject to customary conditions |
| Chrome, Apple, Microsoft and Mozilla root programs | Applications submitted; acceptance pending |
| Classical TLS certificates | To begin only after root-program application and acceptance are complete |
| Production MTC issuance | Scheduled for Q1 2027 |
The acquisition and the root-program applications are separate things. One is a transaction awaiting closing. The others are reviews run by third parties, and Cloudflare does not control their outcome or timing. Treat every date as a plan that can move.
What Merkle Tree Certificates are
Post-quantum signature algorithms tend to be larger than today’s, which inflates the certificate data sent during each connection. Cloudflare’s stated rationale for MTCs is to avoid that cost. Instead of shipping large post-quantum signatures with every connection, MTCs use lightweight proofs that a certificate is included in a registry. Cloudflare says MTC is an IETF draft specification that it co-authored. A draft is not a final standard, and the announcement does not claim otherwise.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Cloudflare also says it will use automated renewal signaling under RFC 9773 so certificate replacement can be triggered across sites during revocations or security updates. This is the expected benefit as Cloudflare describes it. It has not been demonstrated by this CA.
Is quantum-safe certificate issuance available now?
No. Production MTC issuance is scheduled for Q1 2027, and the announcement gives no client compatibility matrix. Whether browsers will accept MTCs at that point is not something the announcement establishes. Don’t assume it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do you need to switch certificates?
Not because of this announcement. Cloudflare says customers will manage classical certificates and MTCs through a unified system, so migration can be gradual rather than a forced cutover. It has not published site-specific migration instructions or a legacy-device compatibility list. Your current certificates keep working as before.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How this differs from Cloudflare’s existing post-quantum work
Cloudflare already ships some post-quantum features, and they are a separate matter from the new CA:
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Key agreement: its documentation (last updated July 3, 2026) says post-quantum key agreement is supported only in TLS 1.3-based protocols, including HTTP/3. It also describes ML-DSA signatures in certain features. Cloudflare says it has researched the area since 2017 and targets 2029 for full post-quantum security across its product suite.
- Origin authentication: a July 29, 2026 engineering post describes ML-DSA support for Authenticated Origin Pulls and Custom Origin Trust Store, covering connections between Cloudflare and origin servers. This is not evidence that browsers accept post-quantum public certificates today.
What to watch next
- Whether the GlobalSign transaction closes, which was expected within about two months of September 29.
- Decisions from the Chrome, Apple, Microsoft and Mozilla root programs, which gate classical issuance.
- Whether production MTC issuance begins in Q1 2027 as scheduled.
- Published client-support details for MTCs, which the announcement does not yet provide.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
