← All posts
This post is written in English.
Cloudflare has long been one of the biggest buyers of public certificates. In a 29 September post, it said it plans to start issuing them itself.
The plan
- Apply to the Chrome, Apple, Microsoft and Mozilla root programs.
- Acquire an established root from GlobalSign, trusted since 2012, to reach older devices.
- Issue through ACME first, so existing users could switch by changing a directory URL.
- Require subscribers to support ACME Renewal Information and keep renewal automated.
- Publish reproducible builds of the signing software, and run a public dashboard for issuance health and incidents.
- Issue Merkle Tree Certificates, designed for a post-quantum world, targeting early 2027.
Why do this?
Cloudflare gives practical reasons: rate limits, validation problems, revocation delays and slow root distribution when relying on outside authorities. It also describes Let's Encrypt's large share of free certificates as a systemic risk if it had a serious outage.
Volumes matter too. Cloudflare expects certificate numbers to grow as lifetimes shrink and automated agents multiply.
What to keep in mind
This is all stated intent. Cloudflare says it "will be a little while" before it issues anything, root program acceptance isn't guaranteed, and classic certificates will stay in use for many more years.
My read
More authorities should reduce the risk of depending on one. But Cloudflare already sits in front of a large share of the web, and adding certificates concentrates another layer in the same company. The public dashboard and reproducible builds are good commitments. I'd judge this by whether they're still maintained in two years.
