Cloudflare moves to become a free certificate authority, buying a trusted root from GlobalSign

Cloudflare announced on September 29, 2026 that it intends to become a public certificate authority. The company has applied to the Chrome, Apple, Microsoft and Mozilla root programs and signed a definitive agreement to buy a root from GlobalSign that has been trusted across browsers, operating systems and devices since 2012. Cloudflare writes that it has been one of the largest users of certificates for more than a decade, but has never issued a single one itself.

What a certificate authority does

For a site to open with a padlock in the address bar, it needs a certificate from an organization that browsers trust, known as a certificate authority. Today, free and automated certificates come almost entirely from one place: Let's Encrypt. That is Cloudflare's argument: most free certificates come from a single source, and if that source had a bad week there would be no comparable free, automated alternative. The company also expects demand to grow as certificate lifetimes shrink, AI agents multiply and post-quantum certificates go mainstream.

Why buy an old root

A brand-new root takes years to spread to devices and never reaches devices that no longer get updates. According to Cloudflare, the GlobalSign root will give it reach to older clients from day one. The company will also submit a new root of its own. The announcement does not say when the purchase will close or which root is involved.

Automated with ACME, a one-line switch

Certificates will be issued through the automated ACME protocol. According to the post, anyone using another free certificate authority will be able to switch by changing a directory URL, with no new tooling. There is one condition: Cloudflare will only issue to clients that support ACME Renewal Information (ARI, RFC 9773), so it can pull renewals forward if a security problem affects a batch of certificates.

In a second post the same day, the company laid out its post-quantum plan. Because post-quantum signatures are much larger than today's, Cloudflare will use Merkle Tree Certificates, which sign batches of certificates instead of each one individually. The first production certificates of this kind are targeted for the first quarter of 2027, and standard issuance will be free. Cloudflare also says it served such certificates billions of times in a Chrome Beta trial on its own domains.

No certificates are being issued yet, and Cloudflare says it will take a while. Acceptance depends on each browser's own review, and for Merkle Tree Certificates only Chrome's program is discussed so far. The posts also do not say whether existing Cloudflare customers will be moved to the new authority automatically. To see how it works out, it is worth following the root programs' decisions and evaluations from independent security researchers.

Sources: Cloudflare: Building a certificate authority for the whole Internet, Cloudflare: Building a post-quantum certificate authority with Merkle Tree Certificates.