Cloudflare to Issue Quantum-Safe TLS Certificates

Cloudflare's Quantum-Safe TLS Overhaul

On September 30, 2026, Cloudflare revealed its commitment to issue quantum-proof TLS certificates—one of the first organizations to deploy post-quantum cryptography at scale. The initiative represents a fundamental reimagining of the Web Public Key Infrastructure (WebPKI), designed to future-proof internet communications against the computational power of quantum computers.

The core of Cloudflare’s strategy lies in a hybrid approach: alongside traditional TLS certificates, the company will release Merkle Tree Certificates—a post-quantum alternative that replaces vulnerable signature chains with compact, hash-based proofs. These certificates are offered freely to both commercial and non-commercial users, eliminating cost barriers to adoption.

To accelerate widespread deployment, Cloudflare has acquired a trusted root certificate from CA GlobalSign, providing the foundation needed to integrate quantum-safe roots across the existing ecosystem. The goal is seamless transition—millions of websites could adopt post-quantum protection with minimal configuration and zero measurable performance degradation.

However, the path forward demands significant architectural shifts. Traditional X.509 certificates require roughly forty times more data during handshakes than Merkle Tree proofs, potentially breaking the internet if naively adopted. Google’s earlier exploration of Merkle Trees demonstrated that hierarchical data structures can reduce handshake payloads to approximately 40 kilobytes while maintaining robust verification. Cloudflare’s implementation builds on this success, leveraging shared root programs and collaborative efforts within the WebPKI community to ensure interoperability and trust.

This transformation underscores a broader industry imperative: securing the backbone of AI and GPU-driven workloads. As machine learning models grow more complex and distributed training becomes standard, the integrity of data transmission and authentication becomes paramount. Quantum-safe TLS ensures that sensitive model outputs, proprietary datasets, and control signals remain protected against emerging threats, safeguarding both intellectual property and operational continuity.