Cloudflare Builds Public Certificate Authority, Prepares Internet for Quantum Computing Threat

Cloudflare announced a strategic plan to become a public certificate authority (CA) for website operators, a move that puts the cloud security company in direct competition with established players in the internet's public key infrastructure (PKI). The company will issue conventional web certificates as well as post-quantum Merkle Tree Certificates (MTC) through a single integrated service.

To accelerate trust in the certificates it will issue, Cloudflare has agreed to acquire publicly trusted Root CA key material from GlobalSign. The transaction is expected to close within the next two months, subject to customary closing conditions. The move is considered crucial because an established root allows Cloudflare certificates to be recognized immediately, including by older smartphones, legacy operating systems, and devices that no longer receive security updates.

Cloudflare has also applied to have its certificates included in the root programs of Chrome, Apple, Microsoft, and Mozilla. Issuance of classic certificates is planned after the application and acceptance process in the browser root programs is complete. Meanwhile, production-scale MTC issuance is scheduled for the first quarter of 2027. The company said the move is a continuation of its successful experiment with Chrome.

In Cloudflare's view, trust in the web's current public key infrastructure is too centralized among a handful of dominant issuers. That condition creates systemic risk if one issuer fails or is hacked. The company also warned that quantum computers capable of breaking current encryption are expected within the next few years, while most of the web is not ready to face them. The planned CA will add a large-scale independent issuer, according to the company.

"Twelve years ago, Cloudflare made encryption free and automatic for millions of websites. Today, we are taking the next step by building a Certificate Authority that is open, transparent, and reliable for the entire internet," said Cloudflare CEO and co-founder Matthew Prince.

Prince added that improving web security before quantum computers can break it is one of the greatest coordination challenges in internet history. By balancing support for legacy devices and the latest post-quantum technology, Cloudflare aims to provide a permanent safety net so the internet remains fast, reliable, and secure for all devices.

MTC itself uses lightweight proofs to confirm that a certificate has been recorded in a trusted registry, so it does not need to send heavy post-quantum signatures on every connection. Cloudflare said website owners will manage conventional TLS certificates and MTC in one system, enabling a transition without sudden outages or rebuilding devices. The company also plans to publish operational and technical information, reproducible build code, and a live public health dashboard. Automatic update signals under RFC 9773 will trigger certificate replacement in the background across millions of sites instantly, reducing the risk of mass disruption during revocation or security updates.

For Indonesia, Cloudflare's move touches the pulse of the digital economy directly. As one of the largest internet markets in Southeast Asia, Indonesia has millions of MSME sites, e-commerce platforms, and public services that rely on TLS certificates for transaction security. As Cloudflare expands certificate issuer options, domestic site operators could enjoy more competitive costs and faster innovation. However, post-quantum MTC adoption also demands local infrastructure readiness, including awareness of the transition from legacy cryptographic algorithms. The government, through BSSN and Kominfo, needs to ensure national cybersecurity regulations align with these new standards so that certificate fragmentation does not confuse businesses.

On the other hand, Cloudflare's dominance as a global security and CDN service provider could strengthen its position in the Indonesian market. If its CA is widely accepted, dependence on a single provider will grow, raising questions about digital sovereignty and risk diversification. Local companies in cybersecurity may need to form partnerships or develop equivalent services to stay competitive.

Going forward, the question is no longer whether the internet will move to post-quantum, but how fast and who controls the transition. Cloudflare has planted a milestone, but the success of its plan depends on acceptance by browsers, regulators, and the readiness of the global ecosystem—including Indonesia—to leave legacy cryptography behind.