Security
Cloudflare to Issue Quantum-Resistant TLS Certificates
The infrastructure company will become among the first to issue post-quantum cryptographic certificates, starting with acquisitions and hybrid certificate support.
Ars Technica
Cloudflare announced plans to begin issuing TLS certificates designed to resist attacks from future quantum computers, positioning itself as a pioneer in quantum-safe digital security. The company will offer these hybrid certificates for free to all users—both paid and unpaid—leveraging an open-source platform that combines traditional and post-quantum cryptography.
Building the Foundation#
To scale this initiative across the web's certificate infrastructure, Cloudflare is acquiring a trusted certificate root from CA GlobalSign. This move aims to enable millions of websites to adopt post-quantum certificates with minimal friction—essentially a toggle switch without performance penalties. Cloudflare's announcement outlined how it will issue both standard TLS certificates and post-quantum alternatives, specifically Merkle Tree Certificates.
The Quantum Cryptography Challenge#
The transition to quantum-safe web encryption demands wholesale architectural changes rather than simple algorithm substitution. Moving to quantum-resistant X.509 certificates would require roughly 40 times more data per TLS handshake—the process that initiates every browser-server session. This explosion in computational and bandwidth demands would overwhelm the existing internet infrastructure.
Cloudflare must also solve how to transmit quantum-proof signatures efficiently across web requests and log them in transparency systems that prevent fraudulent certificates. The full makeover will require years of coordinated effort across operating systems, browsers, certificate authorities, and network infrastructure providers.
A Public Commitment#
"We are not issuing certificates yet, and it will be a little while before we do," Cloudflare engineer Steve Goldsmith noted. The company committed to working transparently with the WebPKI community, sharing milestones and plans as development progresses. This coordinated approach across the certificate authority ecosystem is essential—no single provider can quantum-proof the web alone.
