Cloudflare is preparing to become a public Certificate Authority, with plans to offer free, automated TLS certificates to website owners through the widely used ACME protocol.
Until now, Cloudflare has been one of the Internet’s largest consumers of publicly trusted certificates rather than an issuer. That is about to change, as the company says it has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs.
The company has signed an agreement to acquire an established GlobalSign root certificate trusted across browsers, operating systems, and devices since 2012. This matters because a new root can take years to reach enough devices to become broadly useful, while an existing trusted root gives Cloudflare compatibility with older systems from the start.
For website owners and Linux administrators, however, the most interesting part is how certificates will actually be issued. Cloudflare says its new CA will be built around ACME, the same open protocol widely used today for automatically obtaining and renewing TLS certificates.
That means administrators already using an ACME-compatible setup should not need a new toolchain. According to Cloudflare, moving from another free CA could be as simple as changing the ACME directory URL.
This puts the upcoming service in the same space occupied today by Let’s Encrypt, although Cloudflare describes the move primarily as a way to add redundancy to the certificate ecosystem rather than replace it.
Let’s Encrypt currently issues around 10 million certificates per day and serves more than 500 million websites. Cloudflare argues that having such a large part of the encrypted web dependent on one dominant free and automated CA introduces systemic risk. If that infrastructure experiences a serious outage or problem, there are few alternatives capable of taking on comparable demand immediately.
Cloudflare already follows a similar redundancy model for its Universal SSL service, where certificates are backed by alternatives issued through different authorities. Its public CA is an attempt to extend that approach beyond Cloudflare customers.
There will be some requirements. Cloudflare says certificate issuance will depend on automated renewal support, including ACME Renewal Information, standardized as RFC 9773. ARI lets a certificate authority tell clients when to renew, which helps distribute renewals more efficiently during incidents or large-scale replacements.
Cloudflare also plans to make parts of the CA’s operation more visible. The company intends to publish reproducible builds of its certificate-signing software, provide attestations for the hardware security modules holding its keys, and operate a public dashboard covering issuance health and incidents.
On top of that, Cloudflare also plans to become one of the first public CAs to issue production Merkle Tree Certificates, or MTCs, targeting the first quarter of 2027. MTCs are developed as a more compact certificate format suitable for post-quantum authentication, where traditional certificate chains could become larger and add overhead on TLS connections.
Finally, one important detail needs to be clear: Cloudflare is not issuing public certificates yet. Its root applications still need to move through the relevant trust programs, and the company has not announced a firm date for when general certificate issuance will begin.
Once it does, though, the arrival of another large, free, ACME-compatible Certificate Authority could be particularly useful for Linux server administrators and self-hosters already relying on automated TLS deployments.
For additional details, see Cloudflare’s official announcement.
