Cloudflare agrees to buy a GlobalSign root so its new certificate authority works on old devices

A new root is slow to become useful. Even after a root program accepts it, the root has to propagate into operating systems, browsers and devices, and it never reaches clients that have stopped receiving updates ^[10]. Buying an existing root skips that wait. GlobalSign's has been trusted across browsers, operating systems and devices since 2012 ^[11], so it is about 14 years old ^[1].

Age is also a liability. The new root Cloudflare will submit is built for root programs that are starting to cap how old a trusted root may be ^[13]. "The established root gives us reach across the devices of the past. The new roots give us standing under the policies of the future," Cloudflare wrote ^[14]. I think two roots is the right design for a CA that wants old clients on day one. The bought root serves the long tail now, while the new one starts its years of propagation under the newer rules ^[13].

For more than a decade Cloudflare has been one of the largest consumers of publicly trusted certificates, by its own account, without issuing one ^[15]. It sits in front of more than 20 percent of global Internet request traffic ^[16]. Its own CA "would also place the company alongside established providers that currently supply its certificates," RuntimeWire wrote ^[17]. GlobalSign, the seller of the root, is not one of the four partners RuntimeWire found in Cloudflare's documentation ^[2]. Neither source says Cloudflare will stop buying from any of them.

The pitch is redundancy for free certificates. If the dominant free CA had a bad week, Cloudflare argues, much of the web would have no comparable free, automated alternative ^[22]. That CA is Let's Encrypt, which issues on the order of ten million certificates a day and serves more than 500 million sites, according to Cloudflare ^[18]. The blog calls it one of the best things to happen to the Internet in twenty years ^[19], then proposes to take some of its load. Universal SSL already works this way at the certificate level: every certificate ships with a backup under a separate key, issued by a different authority ^[20]. "A public CA is that same idea, but at the scale of the whole Internet," Cloudflare wrote ^[21].

Post-quantum is the harder engineering problem. Simply swapping post-quantum signatures into certificates at Internet scale would cause unacceptable performance degradation, Cloudflare says ^[23]. Merkle Tree Certificates record issued certificates in a Merkle tree, and an inclusion proof shows that a given certificate belongs to the logged set ^[24]. According to the IETF draft, as RuntimeWire summarised it, the design limits the size cost of post-quantum signatures while keeping issuance publicly accountable ^[24].

So far the evidence is experimental. Cloudflare reports a successful experimental deployment with Chrome this year ^[25], and an IETF presentation reported MTC tests on 1,000 Cloudflare-proxied domains ^[26]. RuntimeWire wrote that this is "evidence of technical testing, not evidence that the proposed CA has been approved" ^[26]. Those domains ran behind Cloudflare's own edge. For the result to transfer to other sites, browsers would have to accept a format that is still being developed at the IETF ^[9].