Cloudflare Plans a Post-Quantum Certificate Authority Using Merkle Tree Certificates

Every secure website proves its identity with a certificate, a signed credential your browser checks before trusting the connection. Cloudflare's plan changes how that proof is packaged so that post-quantum signatures do not make the handshake heavier.

Cloudflare's blog post, "Building a post-quantum certificate authority with Merkle Tree Certificates" (29 Sep 2026), describes the plan. Help Net Security covered it the next day. MTCs are an IETF draft built with Google Chrome. They replace the full certificate chain with one signature, one public key and an inclusion proof under 1 kB.

Cloudflare is buying root key material from GlobalSign and has applied to the Chrome, Apple, Microsoft and Mozilla root programs. It is targeting inclusion in Chrome's Quantum-resistant Root Store in early 2027. A traditional certificate remains as a fallback.

The urgent quantum threat is "harvest now, decrypt later": encrypted traffic captured today could be decrypted years later by a large quantum computer. This is a widely accepted threat model, and it applies to encryption and key exchange, not to signatures or certificates.

That part is already being handled. Cloudflare has defaulted to hybrid post-quantum key agreement since 2022, after experiments beginning in 2019, and major browsers support it. NIST finalized its first post-quantum standards (FIPS 203, 204 and 205) in August 2024.

Certificates come second because signatures only need to be quantum-safe before a quantum computer capable of forging them exists. A forged certificate cannot be applied retroactively to traffic recorded earlier. Website certificates also expire quickly: at most 398 days now, falling to 47 days by 2029 under CA/Browser Forum rules. Only root certificates last for years.

Post-quantum signatures are much bigger. An ML-DSA-44 signature is 2,420 bytes and its public key 1,312 bytes, against about 64 bytes for an ECDSA P-256 signature. Cloudflare says post-quantum signatures are about 40 times larger. A typical handshake carries roughly five signatures and two public keys, which becomes too heavy at those sizes, and on slow links that can mean slower connection setup.

That is the problem MTCs address. Hybrid certificates carrying both a classical and a post-quantum signature guard against one algorithm failing, but they make certificates bigger, so they do not solve the size problem. Cloudflare's post does not describe a hybrid-certificate approach.

Early tests are encouraging but secondhand. A report from IETF 125 (March 2026) said Chrome and Cloudflare tests showed a median handshake about 9% faster than ECDSA (105 ms versus 116 ms). We have not seen the underlying data.

Patient portals, lab results and wearables syncing to apps all rely on certificates to prove who is on the other end. But a certificate does not protect recorded traffic later. The risk to stored or captured health data is about encryption, meaning key exchange, and that is already post-quantum at Cloudflare and in major browsers.

So this is a quiet upgrade to identity checking, not an emergency fix for health privacy. The weakest part of any argument that it matters urgently to personal data is exactly this: the protection against harvesting is already in place.

Here the browser is driving the change. Chrome's Quantum-resistant Root Store is planned to accept only MTCs, with a roadmap date of Q3 2027 per secondary reports. One issuer cannot shift security for everyone by itself.

• Whether the Chrome, Apple, Microsoft and Mozilla root programs approve Cloudflare's applications. • Completion of the GlobalSign root key material deal. • Whether the early 2027 issuance target holds, and the exact Chrome root-store date, which rests on secondary reports.

• Root-program decisions from Chrome, Apple, Microsoft and Mozilla. • The first production MTC issuance in early 2027. • Progress of the MTC draft at the IETF. Education only. Evidence tiers: Verified = confirmed by a primary or widely accepted source; Unverified = not confirmed. Primary source: Cloudflare's announcement at blog.cloudflare.com/pq-ca-with-mtcs (29 Sep 2026); additional coverage by Help Net Security (30 Sep 2026).

Cloudflare Plans a Post-Quantum Certificate Authority Using Merkle Tree Certificates Rule-Last Prompts and Hostile Filenames: Our First Test Did Not Finish