Cloudflare buys a root of trust instead of waiting on the browsers
Cloudflare will issue the certificates that vouch for websites, starting from root key material bought from GlobalSign, with production post-quantum certificates set for Q1 2027. Four browser root programs still have to say yes, and no one has priced what it does to the certificate market.
Vincent Jiang · 2 min read
A bought root beats the queue
Cloudflare said on 29 September that it intends to become a public certificate authority, issuing classical TLS certificates alongside post-quantum Merkle Tree Certificates, with production MTC issuance set for the first quarter of 2027 1. It has applied to the Chrome, Apple, Microsoft and Mozilla root programs; all four applications are pending, and classical issuance starts only after acceptance 13.
The shortcut is publicly trusted root key material bought from GlobalSign, expected to close within two months 13. A root already installed on devices makes certificates work on old phones on day one, no queue required 1. No price was disclosed 1.
The gate, the mint and the till
The move internalizes a dependency. Universal SSL made encryption free for millions of sites in 2014 and, by Cloudflare's account, doubled encrypted web traffic overnight, on certificates other issuers signed 1.
Those free certificates still come from Let's Encrypt, Google Trust Services and SSL.com 4. Even Google Trust Services leans on a GlobalSign root cross-sign, installed on client devices for more than 20 years, for old-device reach 4.
After the deal, Cloudflare mints what it now rents. The company already sits in front of more than 20% of the web, where 17% of sites block AI training, and its customers fired more than one billion HTTP 402 payment responses a day by August 5. Cloudflare now runs the gate, the mint and the till.
GlobalSign sells the anchor
The seller exits rather than fights. GlobalSign, founded in Belgium in 1996 and owned by Japan's GMO group since 2007, is handing over key material, not the company 6. Its root appears in certificate chains covering 20.9% of the websites W3Techs measures, second only to Let's Encrypt's 64.2% 7.
GlobalSign's root already sits under a fifth of the web
Data
| Value | |
|---|---|
| Let's Encrypt | 64.2% |
| GlobalSign | 20.9% |
| Sectigo | 4.6% |
| GoDaddy Group | 3.5% |
| DigiCert Group | 1.6% |
| Actalis | 0.6% |
The browsers still hold the keys
The post-quantum race is real. MTCs exist because a post-quantum signature runs 2,420 bytes against 64 for the elliptic-curve schemes most sites use now 2. Chrome identifies MTCs as its preferred approach for the public web 8, a joint Chrome and Cloudflare experiment announced in October 2025 ran successfully 2, and Let's Encrypt plans its own production MTC environment in 2027 8.
Cloudflare's release calls concentrated trust a systemic risk 1. Four root programs must now decide whether the remedy is one company holding the web's traffic gate, its identity issuer and its payment rail at once. Let's Encrypt, Google Trust Services and SSL.com would lose the free-certificate volume they now sign, and nobody has priced that market 47. The dates to watch: the GlobalSign close, expected within two months, and the four pending acceptances 13.
How this brief was made
01Gathered & sourced280 channels · 1,628 articles▾
Agents swept 280 channels and ingested 1,628 articles, then de-duplicated and ranked them for signal.
02Verified & cross-validated8 claims · 35 data feeds▾
Every one of 8 load-bearing claims was checked against primary sources, with 35 live data feeds reconciling the figures and charts.
- 1Business Wire via Yahoo Finance, "Cloudflare Announces Public Certificate Authority for the Post-Quantum Web", 29 September 2026
- 2SiliconANGLE, "Cloudflare to become a public certificate authority with post-quantum certificates", 29 September 2026
- 3Help Net Security, "Post-quantum website certificates from Cloudflare are scheduled for early 2027", 30 September 2026
- 4Cloudflare developer documentation, "Certificate authorities", last updated 16 April 2026
- 5PPC Land, "Cloudflare CEO expects bot traffic to hit 1,000 times human within 5 years", 29 September 2026
- 6Wikipedia, "GlobalSign", last edited 15 June 2026
- 7W3Techs, "Usage Statistics and Market Share of SSL Certificate Authorities for Websites", 30 September 2026
- 8Help Net Security, "Let's Encrypt works toward post-quantum certificates at web scale", 5 June 2026
03Reviewed & edited2 human editors▾
2 editors read the draft against the evidence, tuned the framing, and signed off before it shipped.
Become a contributor
Reporting on the business of AI and want it read? We take pitches from outside contributors who bring primary sources and a number worth arguing about.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
