Cloudflare Launches Post‑Quantum Certificate Authority Using Merkle Tree Certificates
What Happened – Cloudflare announced that it is now operating a public‑key certificate authority (CA) that issues Merkle Tree Certificates (MTCs). MTCs embed post‑quantum‑resistant signatures while preserving performance at Internet scale. The service will be free, with the first Chrome‑compatible quantum‑resistant root store expected in early 2027.
Why It Matters for Trust & Control Assurance
- Demonstrates a concrete path for meeting cryptographic‑control objectives that require quantum‑resistant algorithms, a control area increasingly referenced in audit frameworks.
- Provides publicly auditable issuance via Cloudflare’s Certificate Transparency (CT) logs, giving organizations defensible evidence of compliance with transparency and key‑management requirements.
- Enables continuous control‑assurance programs to capture evidence of a secure, future‑ready TLS authentication stack without sacrificing performance.
Who Is Affected – Enterprises and SaaS providers that rely on TLS for web services, CDN customers, and any organization that must demonstrate strong cryptographic controls to regulators or auditors.
Recommended Actions
- Review your TLS certificate lifecycle policy and map the upcoming post‑quantum requirement to the relevant control objective (cryptographic protection).
- Begin collecting evidence of current certificate issuance processes (CT log submissions, key‑management procedures) to support future audits.
- Pilot MTC issuance for high‑risk external‑facing services and document the results in your control‑evidence repository.
Source: Cloudflare Security Blog
Technical Notes
- Merkle Tree Certificates use a Merkle‑tree‑based aggregation of signatures to achieve post‑quantum security with low latency.
- Cloudflare continues to operate the Nimbus CT log family and is adding the Raio static CT logs for transparent issuance.
- The quantum‑resistant root store is slated for Chrome rollout in early 2027, aligning with industry timelines for PQ migration.
Source: Cloudflare Security Blog