Cloudflare applies to become a certificate authority that issues post-quantum certificates in 2027

A customer's phone that has stopped getting software updates will never add a new root certificate to its trusted list ^[12]. Cloudflare's answer for that phone is the established root it intends to buy ^[13]. The announcement did not name the root or give a date for conventional issuance, which starts only after the browser root programs accept Cloudflare's applications ^[19][17].

Cloudflare pitches the new authority as preparation for the point when quantum computers can break current encryption ^[1]. Upgrading the web's security before that happens is "one of the biggest coordination challenges in the history of the internet," Chief Executive Matthew Prince said ^[10]. He tied the move to Universal SSL, the free certificate program Cloudflare launched in 2014 and says doubled the web's encrypted traffic overnight ^[11]. What is actually scheduled is one certificate format, issued from the same system as conventional ones ^[2].

Size is why the format exists. In the published comparison, each post-quantum signature is about 38 times the size of its elliptic curve counterpart ^[1]. According to Cloudflare, a joint experiment with Google's Chrome team, announced last October, was successful ^[6].

Cloudflare expects machines that can break today's encryption within years ^[4]. Going by the plan, site owners on Cloudflare will do very little on the server. They will manage both certificate types from one system ^[16], and RFC 9773 renewal signals let Cloudflare swap certificates across millions of sites in the background during a revocation ^[20].

The authority also changes who signs. Cloudflare's developer documentation names three outside issuers, Let's Encrypt among them, for Universal SSL ^[8]. The company called the web's reliance on a few dominant issuers a systemic risk if one fails or is compromised ^[9]. Its own operation is meant to be open to inspection between audits, with reproducible code builds and a live public health dashboard; certificate authorities today are mostly checked through periodic audits ^[15].

I think starting now makes sense for one group: teams whose clients no longer update. The tradeoff is that their plan depends on a root they cannot test against until Cloudflare names it. Two questions place each team in one box: who terminates your TLS, and whether your clients still take updates.

- Cloudflare terminates, clients update. Swaps are Cloudflare's job ^[20], and waiting costs little. - Cloudflare terminates, clients frozen. Coverage rests on the root Cloudflare buys ^[13]. - You terminate, clients update. The decision is an issuer, and Let's Encrypt is a second source for the format ^[7]. - You terminate, clients frozen. These devices never add new roots ^[12], so post-quantum certificates reach them only through a root they already hold.