Cloudflare said Tuesday it intends to become one of the first certificate authorities to issue quantum-resistant TLS certificates designed to withstand potential attacks from quantum computers. The initiative represents a significant step toward modernizing the internet’s public key infrastructure in preparation for the post-quantum era.
The company will deploy an open source platform capable of issuing both conventional TLS certificates and post-quantum variants known as Merkle Tree Certificates. These hybrid certificates will be available at no cost to both paying and non-paying users. To establish widespread adoption across the certificate ecosystem, Cloudflare is acquiring a trusted certificate root from CA GlobalSign, enabling millions of websites to transition to post-quantum certificates with minimal operational effort and without incurring performance penalties.
Implementing quantum-safe cryptography presents substantial technical challenges. Traditional approaches would require expanding TLS handshake data by roughly 40 times its current size, rendering the internet impractical. Google’s February announcement of Merkle Tree solutions addressed this problem by employing hierarchical data structures with cryptographic hashing to reduce handshake data to approximately 40 kilobytes, comparable to current levels. The Merkle Tree approach replaces vulnerable signature chains with compact cryptographic proofs, allowing a single certificate authority signature to represent millions of certificates.
Cloudflare’s architecture integrates transparency logging directly into certificate issuance rather than treating it as a separate process. The company will employ the Automated Certificate Management Environment mechanism for issuing and continuously renewing certificates. The design also accommodates out-of-band signature transmission through browser updates when technical issues prevent landmark updates. This comprehensive overhaul of the WebPKI ecosystem will require coordinated efforts across browser developers, operating system designers, and infrastructure providers over an extended period. Cloudflare expects to begin issuing certificates in the first quarter of 2027.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI