Cloudflare to issue post-quantum TLS certs that add almost no handshake weight

In September 2026 Cloudflare announced plans to issue quantum-proof TLS certificates, becoming one of the first authorities to do so. The obstacle was size: quantum-proof versions of today's X.509 certificates would add roughly 40 times the data to every TLS handshake — 'it would break the Internet as we know it', the company wrote.

The way out is an architectural replacement rather than an algorithm swap. Announced by Google in February and tested in limited pilots by Google and Cloudflare, Merkle Tree Certificates use hierarchical hashes so a certificate authority signs only a single 'tree head' that can represent millions of certificates; in most cases a browser handles a 'landmark', a lightweight proof that a certificate sits somewhere in the tree.

The design folds two systems into one. Today, certificates must also be published in append-only transparency logs — a reaction to the 2011 DigiNotar hack that minted 500 counterfeit Google certificates — but logging is separate from issuance. With Merkle Tree Certificates, engineer Mari Galicer says, 'transparency becomes a requirement for operation, rather than an add-on', closing the gap that quantum attackers could exploit to forge signed certificate timestamps.

To make the certificates trusted everywhere, Cloudflare is acquiring an established root from GlobalSign and will issue free hybrid classic-plus-post-quantum certificates to paying and non-paying users alike, with ACME-based automated renewal and out-of-band signature delivery (via browser updates) as a fallback. The company committed to the work in public, with certificate issuance expected to start in the first quarter of 2027.

Don't chain quantum-proof signatures — replace the chain itself: one signed tree head covers millions of certificates, verified by a small landmark proof.

It solves the size problem that made post-quantum web certificates look infeasible: proofs stay around 40KB instead of 40x inflation.

Issuance and transparency logging are coupled, so a certificate cannot exist unlogged — closing a forgery surface quantum computers could exploit.

Acquiring an already-trusted GlobalSign root sidesteps the years-long trust-building that new certificate authorities normally need.

Free, hybrid, flip-of-the-switch rollout targets ubiquity across millions of websites, not a premium enterprise tier.

When a required upgrade is too big to ship, redesign what has to be carried: the fix wasn't stronger signatures but a data structure that proves membership without transmitting the whole chain.

Cloudflare said it was not yet issuing certificates and would share milestones publicly while working with root programs and the WebPKI community; issuance was expected to begin in the first quarter of 2027 as part of a multi-year overhaul of website authentication.