Cloudflare has a new playground: it now aims to become a public certificate authority.
It has submitted its own root key to the market’s major trust stores (Chrome, Apple, Microsoft, Mozilla). Because the enrollment process can take several years, it also purchased one from GlobalSign. In operation since 2012, that certificate will allow quicker coverage… and broader reach. The goal is to address older devices that have reached end-of-support, which its own root might otherwise struggle to reach.
When Cloudflare frames Let’s Encrypt as a systemic risk
Cloudflare promises an alternative to Let’s Encrypt. Its argument: this authority, which currently issues nearly 40% of publicly trusted TLS certificates, introduces a systemic risk. In the event of a failure, there is no competitor capable of absorbing the load free of charge and in an automated fashion.
In the absence of having issued its own certificates so far, Cloudflare can claim experience as an intermediary. For each domain configured on its network, it obtains certificates from partner authorities. This, it asserts, has allowed it to identify weaknesses in the Web PKI (certificate request caps, slow mass revocation, policy changes at CAs…).
More broadly, Cloudflare anticipates a growing demand for certificates for three main reasons. Among them, the shortening of certificate lifetimes, driven particularly by Apple and Google. There is also the activity of autonomous agents, which leads to a proliferation of microservices requiring their own cryptographic identities.
The next step with Merkle trees
The third reason is the post-quantum transition. Cloudflare wants to be among the first certificate authorities to ride this wave. It aims to be admitted in early 2027 to the program recently opened by Chrome.
The approach will rely on MTCs (Merkle Tree Certificates), which have established themselves in the ecosystem as the reference technical solution. They are the subject of a specification project within the IETF. Broadly speaking, instead of signing each leaf certificate individually, they are batched into a Merkle tree whose root is signed. Clients then only need to verify an inclusion proof (a logarithmic chain of cryptographic hashes).
The MTCs reuse the standard X.509 container by inserting a signature algorithm identifier. They are issued in two forms. In what is called autonomous form, the certificate carries everything the client needs. In the form called “with a marker,” the certificate authority groups all active certificates into a set of subtrees, forming a common temporal reference. Clients receive upstream, out-of-band, the signed tree heads. The server then transmits only the inclusion proof, removing post-quantum signatures from the TLS negotiation. This mechanism allows a handful of signatures to secure billions of certificates. It does, however, require the ability to update clients. Hence the need to preserve the autonomous mode.
Scaling up the transparency mechanism
Cloudflare will base its infrastructure on a fork of Boulder, the system used by Let’s Encrypt. Issuance flows will rely on the standard ACME protocol. They will involve—an attribute of the MTC era—independent cosignatories. These cosignatories will store copies of issuance logs and will verify that the Merkle tree grows strictly by addition, without fraudulent forks.
Only after external cosigner validation can the certificate authority assemble the final MTC object. This object will contain the cosignatures, the public key of the requesting server, and the Merkle inclusion proof.
At the same time, Cloudflare envisions evolving the transparency system of the Web PKI. It would require every CA to submit every certificate to at least two public registries. But this is not native to X.509. Its post-hoc addition introduces inefficiencies, starting with the frequent multi-recording of certificates. Their cost will become even more significant with post-quantum signatures, as the volumes to ingest are expected to rise markedly (about 40x, according to Cloudflare).
In the MTC era, this mechanism should become native. The registry would store only public-key hashes and the signature on the tree head would mathematically cover the entire log.
A promising Chrome experiment
An experiment was conducted with 50% of the users of the Chrome 146 beta. Cloudflare deployed a fake authority issuing, for a sample of sites hosted on its free plan, MTCs backed by a conventional certificate chain.
On billions of certificates served, the autonomous TLS negotiation proved 9% faster than with a traditional chain of signatures. Cloudflare acknowledges that, as of now, most of the gain comes from eliminating intermediate certificates. However, having tested the MTCs with classic signatures, it says it expects a significantly larger gain in a post-quantum setting.
To avoid creating a new bottleneck, cosignature operators will need to emerge. And more simply, another set of CAs will need to transition to a post-quantum regime…
