Cloudflare to Serve as a Certificate Authority: What It Means for Web PKI, Resilience, Quantum, and Other PKI Players

In a press release on the September 29, Cloudflare announced that it intends to become a public Certificate Authority (CA), with plans to offer a free, open-source service for digital certificate issuance alongside established CAs like Let’s Encrypt, DigiCert, Sectigo, HID Global, and GlobalSign, including both classical and post-quantum certificates. The move represents an expansion of Cloudflare’s prominent position within web-based encryption and has the potential to reshape the web PKI landscape and, more broadly, the adjacent enterprise PKI sphere, particularly with regard to quantum innovation.

While certificate issuance by Cloudflare has not yet begun, the impact of its announcement largely hinges on the certificate type being issued. For classic certificates, issuance remains dependent on Cloudflare’s completion of and acceptance by the browser root program application. Cloudflare has announced its application to root programs operated by Microsoft, Apple, Chrome, and Mozilla, but the acceptance process varies depending on the given browser or Operating System’s (OS) root program. It could be a matter of months; it could take 1 to 2 years. Cloudflare’s move to acquire existing, publicly trusted Root CA material (trusted since 2012) from GlobalSign sidesteps the years-long process of getting a new root to old devices, providing Cloudflare with coverage across devices from the outset. Importantly, this does not circumvent the browser acceptance process, pushing out any immediate impact on competitive dynamics in the CA space.

Although the impact of Cloudflare’s announcement may take some time to materialize, that is not to discount its potential repercussions on the CA player landscape. Cloudflare is at the forefront of web-based encryption and this embedment into the very fabric of web security grants it a headstart when it comes to its newest expansion into certificate issuance, as seen in 2014 when its launch of free Transport Layer Security (TLS) certificates via Universal Secure Sockets Layer (SSL) doubled encrypted traffic on the web. Cloudflare is cutting out the middleman, planning to perform the issuance itself rather than relying on the small community of established issuers, and doing it for free. In this way, Cloudflare sits alongside dominant free CA: Let’s Encrypt. For both Let’s Encrypt and the broader web PKI space, Cloudflare’s transition toward CA status represents a boon for web resilience, expanding the tight network of existing free CAs to enable web security that is not solely contingent on one or two issuers, fortifying it against a single point of failure. Consequently, Cloudflare’s announcement is well-aligned with macro trends across digital security and away from vendor lock-in toward diversified, multi-vendor, and sovereign architectures, as well as growing demand for enhanced redundancy as certificate lifecycles fall (down to 47 days by 2029). All in all, Let’s Encrypt is not hurt by the Cloudflare announcement and, in fact, may garner benefits from it. Cloudflare currently relies heavily on Let’s Encrypt for issuance, so by covering that issuance itself, it provides Let’s Encrypt with more capacity to address a greater portion of the free issuance market.

For commercial CAs on the classical issuance side, there are murmurings that the Cloudflare decision could upset commercial margins by dwindling those CAs’ pricing power. However, in reality, the Cloudflare move to become a CA does not drastically dip into the markets of commercial CAs. Free CAs like Let’s Encrypt and (soon to be) Cloudflare cater to the bulk of SSL certificates, but they do not provide the portfolio that customers in specific, often highly regulated industries demand (e.g., expansive Application Programming Interface (API) access, Certificate Revocation Lists (CRLs), automation beyond the ACME protocol, and integrated certificate management rather than additional solutions tacked on top of free issuance). Consequently, the impact of Cloudflare’s announcement on commercial CAs and enterprise PKI players from the perspective of quantum certificates is much more significant. Cloudflare’s quantum-safe certificates are expected within 1Q 2027 and are set to adopt the Merkle Tree Certificate (MTC) model for quantum resilience, with issuance coming from the same CA used for classical certificates. The compactness of the inclusion proof within MTC bodes well for Cloudflare in terms of both future-proofing its issuance model and addressing the size difficulties introduced by post-quantum signatures. Let’s Encrypt is taking a similar route. But for commercial CAs and for enterprise PKI players, this prospect of free quantum resilient certificates ramps up the pressure to provide quantum-resilient certificates in internal environments. While the PKI players are undoubtedly at the forefront of quantum resilience, they have benefited from the lowering certificate lifecycles mandated by the CA/Browser (CA/B) Forum (with more organizations moving to internal PKI where they can). The offer of free quantum-safe certificates on the CA side does a little to tip the balance, which has, of late, swayed toward enterprise rather than public PKI.

Given the quantum element of Cloudflare’s announcement, enterprise PKI vendors should continue to aggressively position their portfolios and messaging around their quantum capabilities, taking Cloudflare’s move as a catalyst for quantum innovation on the enterprise side. Internal PKI is facing a different compliance picture when it comes to migrating to quantum-safe certificates, lacking the same impetus of the auditor and regulator system that has eyes on public-facing certificates or mandates from the CA/B Forum. While the Cloudflare announcement does not pose a catastrophic threat by any means to existing CAs, the bulk of addressable revenue streams continues to be on the enterprise PKI side. As a result, commercial CAs are expected to continue to ground new capabilities and advancements around enterprise-based considerations, as seen in the expansion of established CAs into the Cryptographic Posture Management (CPM) segment and Non-Human Identity (NHI) space. Orientation around sector-specific PKIs—like X9—is another feasible route for CAs to diversify in the space as more CAs, like Cloudflare, move in.