Cloudflare said on Tuesday it intends to issue quantum-proof TLS certificates, positioning itself among the earliest certificate authorities to offer such credentials. The certificates will employ cryptographic methods designed to resist potential attacks from quantum computers. The company will leverage an open source platform capable of generating both conventional TLS certificates and post-quantum variants called Merkle Tree Certificates, available at no cost to all users regardless of subscription status.
To support this initiative and ensure widespread adoption across the TLS ecosystem, Cloudflare plans to acquire a trusted certificate root from CA GlobalSign. The company stated that this acquisition will enable millions of websites to deploy post-quantum certificates with minimal effort and without experiencing notable performance degradation. Cloudflare emphasized it has not yet begun issuing certificates and that some time will pass before doing so, committing instead to transparent communication about milestones and collaboration with the broader WebPKI community.
The initiative represents part of a comprehensive restructuring of the web public key infrastructure necessary to secure website encryption and authentication in the post-quantum era. A significant technical challenge involves incorporating quantum-resistant signatures that can be efficiently transmitted during web communications and maintained in transparency logs to prevent unauthorized certificate issuance. This comprehensive transformation will require sustained effort from numerous engineers across operating systems, browsers, certificate authorities, and internet infrastructure sectors.
Quantum-resistant versions of standard X.509 certificates would substantially increase TLS handshake data requirements—approximately 40 times the current volume—making direct replacement impractical. In February, Google proposed Merkle Trees as a solution, hierarchical structures using cryptographic hashes to verify large data sets with minimal overhead. Testing by Google and Cloudflare has demonstrated this approach can maintain handshake data at approximately 40 kilobytes, comparable to present levels. The design replaces the current quantum-vulnerable signature chains with compact Merkle Tree proofs, where certificate authorities sign a single tree head representing millions of certificates.
Cloudflare’s plan incorporates additional elements including the Automated Certificate Management Environment for continuous certificate renewal and provisions for out-of-band signature transmission during technical disruptions. The company expects to commence issuing certificates in the first quarter of 2027.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI