Cloudflare to become a public certificate authority with post-quantum certificates

Cloudflare to become a public certificate authority with post-quantum certificates

Cloudflare Inc. today announced plans to become a public certificate authority that will offer certificates designed for the point when quantum computers can break current encryption. The new authority will issue a post-quantum format called Merkle Tree Certificates from the same system as conventional ones.

The format is aimed at a size problem in post-quantum certificates. Output from one of the newly standardized post-quantum signature algorithms runs to 2,420 bytes, against 64 bytes for the elliptic curve schemes most sites use now. A typical connection carries several. Cloudflare expects quantum computers capable of breaking today’s encryption within years.

Merkle Tree Certificates, which Cloudflare co-authored as an Internet Engineering Task Force draft specification, avoid sending large signatures with every connection. A lightweight proof that the certificate sits in a trusted public log does the verification work.

Cloudflare said a joint experiment with Google LLC’s Chrome team, announced last October, was successful. Let’s Encrypt, the nonprofit issuer, said in June that it expects to issue the format in production in 2027.

Running its own authority is also a break from how Cloudflare has handled certificates until now. Its developer documentation names three outside issuers, Let’s Encrypt among them, as the authorities signing certificates for Cloudflare’s free Universal SSL program. A small group of dominant providers handles most certificate issuance on the web. Cloudflare called that concentration a systemic risk if any one of them fails or is compromised.

Chief Executive Matthew Prince tied the move to Universal SSL, which Cloudflare launched in 2014 with free certificates for millions of sites. The company says that program doubled the amount of encrypted traffic on the web overnight. Upgrading the web’s security before quantum computers can break it is “one of the biggest coordination challenges in the history of the internet,” Prince said.

Older hardware is one practical hurdle for any new authority. A phone that no longer gets software updates will never add a new root certificate to its trusted list.

Cloudflare plans to acquire an established root certificate that older devices already recognize, which the company said would let its certificates work on legacy hardware immediately. The announcement did not name the root or its current owner. Cloudflare has also applied to the root programs run by Chrome, Apple Inc., Microsoft Corp. and Mozilla Corp.

Operations at the new authority are meant to be open to outside inspection. Cloudflare plans to publish reproducible code builds and run a live public health dashboard, where certificate authorities today are mostly checked through periodic audits.

Site owners will manage conventional and post-quantum certificates from one system. RFC 9773, an internet standard for automated renewal signals, will let Cloudflare swap out certificates across millions of sites in the background during a revocation.

Conventional certificate issuance starts once the browser root programs accept Cloudflare’s applications. The company did not give a date. Production issuance of Merkle Tree Certificates is scheduled to begin in the first quarter of 2027.

Photo: Cloudflare

A message from John Furrier, co-founder of SiliconANGLE:

Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.

15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more

11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network

SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.