Cloudflare Launches Post-Quantum Certificate Authority, Serverless Analytics, and Decision-Making AI Models

Cloudflare Inc. unveiled three major initiatives: a plan to become a public certificate authority (CA) issuing post-quantum Merkle Tree Certificates, the launch of Cloudflare Basin—a serverless data analytics platform—and the introduction of decision-making AI models Clef and Clef-flash. These moves target encryption vulnerabilities, data analytics overhead, and operational AI use cases.

Cloudflare to Become a Public Certificate Authority

Cloudflare Inc. plans to launch a public certificate authority (CA) that will issue post-quantum certificates, according to SiliconANGLE. The initiative aims to address encryption vulnerabilities expected to arise as quantum computing advances. The new CA will issue Merkle Tree Certificates, a format co-authored by Cloudflare as an Internet Engineering Task Force (IETF) draft specification.

Post-quantum encryption faces a significant size challenge: signatures from newly standardized algorithms can reach 2,420 bytes, compared to 64 bytes for current elliptic curve schemes. Merkle Tree Certificates mitigate this by using lightweight proofs that confirm certificates are part of a trusted public log, rather than sending large signatures with every connection.

Cloudflare expects quantum computers to break current encryption standards within years. The company conducted a successful joint experiment with Google’s Chrome team, demonstrating the feasibility of its approach. Let’s Encrypt, another CA, also plans to issue Merkle Tree Certificates in production by 2027.

To ensure compatibility with legacy hardware, Cloudflare intends to acquire an established root certificate recognized by older devices. The company has applied to root programs run by Chrome, Apple, Microsoft, and Mozilla. Conventional certificate issuance will begin once these applications are accepted.

Automated Certificate Management and Historical Impact

Cloudflare’s move follows its 2014 launch of Universal SSL, a program that provided free certificates to millions of websites. According to SiliconANGLE, this initiative doubled the amount of encrypted web traffic overnight, highlighting the company’s ability to scale cryptographic solutions rapidly.

The company will leverage RFC 9773, an internet standard for automated certificate renewal signals, to manage revocations and updates across millions of sites seamlessly. This system allows Cloudflare to swap certificates in the background without manual intervention, reducing operational friction for site owners.

Cloudflare cited the concentration of certificate issuance among a small group of providers as a systemic risk. By becoming a public CA, the company aims to diversify the ecosystem and improve resilience against potential disruptions.

Cloudflare Basin: Serverless Data Analytics

Cloudflare Inc. launched Cloudflare Basin, a serverless data analytics platform designed to simplify and reduce the cost of analytics workloads for small businesses and developer teams. The platform eliminates the need for dedicated servers or data movement, addressing common pain points in data infrastructure management.

Built on Apache Iceberg and Cloudflare’s R2 storage, Basin allows compatibility with analytics engines like Apache Spark and DuckDB. Customers can query data in place without copying or moving files, reducing latency and avoiding egress fees. Cloudflare charges users based on the volume of data analyzed, rather than infrastructure costs.

While Basin competes with established data warehouse providers like Snowflake Inc. and Databricks Inc., Cloudflare positions it as a targeted solution for workloads that benefit from edge computing, rather than a universal replacement for all data warehouse use cases.

Decision-Making AI Models: Clef and Clef-flash

Cloudflare announced two decision-making AI models, Clef and Clef-flash, on October 1, as reported by THE BRIDGE. The models are hosted on Cloudflare’s Workers AI inference service and published on Hugging Face under the Apache License 2.0, enabling local execution.

Clef and Clef-flash are designed for classification and routing tasks, such as triaging customer inquiries or evaluating policy violations. Clef, based on the Qwen3.8-27B model with 27 billion parameters, is positioned for accuracy-critical use cases, while Clef-flash, based on Qwen3.5-9B, prioritizes speed.

Both models support inputs in text, images, and videos. Cloudflare is testing them internally for threat intelligence, including website classification for potential phishing or e-commerce detection. The company also offers a fine-tuning service using reinforcement learning to align the models with specific business criteria.

Background

Cloudflare’s push into post-quantum encryption reflects broader industry concerns about the timeline for quantum computing to break existing cryptographic standards. The company has historically prioritized scalable security solutions, as demonstrated by its Universal SSL program.

The launch of Cloudflare Basin aligns with trends in serverless computing and cost-efficient data analytics, targeting teams lacking resources for dedicated infrastructure. Similarly, the introduction of decision-making AI models underscores Cloudflare’s focus on practical, developer-friendly tools for operational tasks.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Cloudflare’s announcements reflect a strategic focus on scalability, security, and accessibility—core themes for modern internet infrastructure. By becoming a public CA, the company is positioning itself as a critical player in the transition to post-quantum encryption, a move that could reduce reliance on a handful of dominant providers and improve the resilience of web security. The Merkle Tree Certificates approach is particularly notable for its practicality, addressing the size limitations of post-quantum signatures without requiring hardware upgrades.

Cloudflare Basin and the Clef models demonstrate the company’s commitment to democratizing complex technologies. Basin’s serverless architecture targets smaller teams and businesses, removing barriers like infrastructure costs and data movement overhead. Meanwhile, Clef and Clef-flash offer flexible, task-specific AI tools that can be fine-tuned for operational decision-making, a gap many organizations struggle to fill with general-purpose models.

For founders and operators, these developments highlight two key opportunities. First, Cloudflare’s post-quantum CA could provide a simpler path to future-proof encryption, especially for teams without dedicated cryptography expertise. Second, Basin and the Clef models lower the barrier to entry for advanced analytics and AI-driven operations, allowing smaller players to compete without massive infrastructure investments. However, the success of these initiatives will depend on adoption—both in terms of browser and hardware compatibility for certificates, and developer engagement for Basin and Clef.

Key takeaways

• Cloudflare is positioning itself as a public CA to issue post-quantum certificates, aiming to upgrade web security before quantum computers break current encryption.
• Merkle Tree Certificates, co-authored by Cloudflare, mitigate size issues in post-quantum encryption by using lightweight proofs instead of large signatures.
• Cloudflare Basin targets small businesses and developer teams, offering cost-effective, serverless data analytics without infrastructure overhead.
• The Clef and Clef-flash models are tailored for decision-making tasks, supporting text, images, and videos, and are available for local execution.
• Cloudflare’s strategy includes acquiring a root certificate for legacy compatibility and automating certificate renewal for millions of sites.

FAQ

What are Merkle Tree Certificates, and why do they matter?

Merkle Tree Certificates are a post-quantum encryption format co-authored by Cloudflare as an IETF draft specification. They address the size problem in post-quantum signatures by using lightweight proofs instead of large signatures per connection, making them more efficient for widespread use.

How does Cloudflare Basin differ from traditional data warehouses?

Cloudflare Basin is a serverless data analytics platform that eliminates the need for dedicated servers or data movement. Unlike traditional data warehouses, it allows querying data in place, reducing egress fees and infrastructure overhead. It is designed for cost efficiency and ease of use, particularly for smaller teams.

What are Clef and Clef-flash used for?

Clef and Clef-flash are AI models designed for classification and routing tasks, such as triaging customer inquiries or evaluating policy violations. Clef is optimized for accuracy, while Clef-flash prioritizes speed. Both support inputs in text, images, and videos and can be fine-tuned for specific business needs.

Why is Cloudflare acquiring a root certificate?

Cloudflare plans to acquire an established root certificate to ensure compatibility with legacy hardware, which may not support new root certificates due to outdated software. This approach allows the company’s post-quantum certificates to work immediately on older devices.

When will Cloudflare’s post-quantum certificates be available?

Production issuance of Merkle Tree Certificates is scheduled for the first quarter of 2027, pending approval from browser root programs run by Chrome, Apple, Microsoft, and Mozilla.

Related on Lazyfounder

• More technology news
• IBM and CoreWeave co-design workload controls for AI agent infrastructure
• OpenAI Safety Researcher Resigns, Warns of Reckless AI Development