Cloudflare Announces Plans to Become Public Certificate Authority

Cloudflare has announced its intent to become a public certificate authority (CA), marking a significant shift after years of being one of the largest consumers of publicly trusted certificates. The company has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and has signed a definitive agreement to acquire an established GlobalSign root, which has been trusted across browsers, operating systems, and devices since 2012. By acquiring this root, Cloudflare will provide certificates that reach older clients that a new root would not serve, ensuring broad device compatibility from day one. Cloudflare’s new CA will be ACME‑first, allowing automated issuance and renewal through the widely accepted protocol. The company will also be among the first to issue post‑quantum certificates, targeting Chrome’s Quantum‑resistant Root Program. While certificates are not yet being issued, Cloudflare is committed to transparency, sharing milestones publicly and building a resilient CA that limits the impact of any single issue. The move aims to strengthen the free‑certificate ecosystem, which currently relies heavily on Let’s Encrypt, by adding redundancy and ensuring that the Internet’s encrypted traffic remains secure even if a dominant CA experiences a problem.