Cloudflare said it plans to begin issuing quantum-resistant TLS certificates, positioning itself among the first certificate authorities to offer such credentials. The company will utilize an open-source platform that simultaneously delivers conventional TLS certificates and post-quantum alternatives known as Merkle Tree Certificates. The hybrid certificates will be available at no cost to all users, whether they maintain paid accounts with Cloudflare or use free services.
To establish the infrastructure necessary for widespread adoption, Cloudflare is acquiring a trusted certificate root from CA GlobalSign. The initiative aims to enable millions of websites to implement post-quantum certificates without substantial performance penalties. The undertaking reflects broader industry efforts to modernize the web public key infrastructure before quantum computers mature enough to compromise current cryptographic standards.
The transition to quantum-safe encryption presents significant technical challenges. Standard approaches would dramatically increase data requirements during TLS handshakes, adding roughly 40 times the current overhead. Google proposed a solution earlier this year using Merkle Trees, hierarchical data structures that employ cryptographic hashes to verify information while minimizing data transmission. Testing in pilot programs demonstrated that this approach reduces handshake data to approximately 40 kilobytes, comparable to present levels.
Cloudflare’s approach integrates Merkle Tree Certificates with enhanced transparency mechanisms. Unlike the current system where certificate logging operates separately from issuance, the new design incorporates logging as an integral component. This architecture ensures transparency functions as a fundamental requirement rather than an ancillary feature. The company also plans to incorporate ACME, an open-source certificate management mechanism enabling automated issuance and renewal.
Cloudflare stated it will not issue certificates immediately but committed to sharing project milestones publicly while collaborating with other WebPKI community members. The company expects to launch certificate issuance in the first quarter of 2027, acknowledging that completing the ecosystem overhaul will require years of coordinated work across browser developers, operating system designers, and infrastructure providers.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI