Loading story…
Cloudflare has applied to the root programs operated by Google Chrome, Apple, Microsoft, and Mozilla to become a publicly trusted certificate authority (CA) capable of issuing TLS/X.509 certificates directly to customers. The company is also pursuing acquisition of an already trusted GlobalSign root certificate, reportedly GlobalSign Root R5, to enable certificate issuance before its own root is broadly embedded in client trust stores.
Cloudflare plans to require certificate customers to use ACME automation and the ACME Renewal Information (ARI) extension, supporting automated certificate renewal, revocation, and reissuance. It also intends to begin experimental issuance of post-quantum Merkle-Tree Certificates (MTCs) alongside conventional certificates in 2026, expanding its role from CDN and security provider to public Web PKI operator.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Cloudflare announced plans to operate a public certificate authority and issue TLS/X.509 certificates to customers. It applied to the root programs of Chrome, Apple, Microsoft, and Mozilla, and plans to acquire a browser-trusted GlobalSign root certificate to support issuance while its own root seeks trust.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google announced a new Chrome program to make HTTPS certificate authentication resilient to future quantum attacks by evolving Certificate Transparency (CT) toward **Merkle Tree Certificates (MTCs)**. The approach is designed to mitigate the risk that a sufficiently capable quantum computer running **Shor’s algorithm** could forge classical signatures used in today’s PKI/CT ecosystem (e.g., forging **Signed Certificate Timestamps** to make unlogged certificates appear valid). Rather than immediately adding post-quantum X.509 certificate chains into the **Chrome Root Store**, Google is pursuing MTCs through the IETF’s new **PLANTS** working group (*PKI, Logs, And Tree Signatures*), replacing heavyweight serialized signature chains with compact Merkle proofs of inclusion anchored by a CA-signed tree head. Google’s design combines classical and post-quantum cryptography (including **ML-DSA**) so an attacker would need to break both to successfully forge proofs, while keeping handshake/CT authentication data small. Ars Technica reports Google is using “clever math” to keep MTC-related authentication artifacts roughly **64 bytes** (similar to current CT proofs) despite post-quantum key and signature size growth, and that the system is already implemented in Chrome with **Cloudflare** enrolling roughly **1,000 TLS certificates** to test MTC behavior; Cloudflare is currently generating the distributed ledger, with a plan for CAs to eventually assume that role.
Aug 4, 2026
Let's Encrypt said it will use **Merkle Tree Certificates (MTCs)** as its preferred approach for post-quantum authentication on the public web, arguing that conventional post-quantum signatures such as `ML-DSA` would make standard TLS certificate chains too large for reliable internet-scale handshakes. The model batches certificate issuance under a single signed Merkle tree head and delivers compact inclusion proofs, reducing handshake overhead while making Certificate Transparency inherent to issuance. Let’s Encrypt said current subscribers do not need to take immediate action, but future ACME clients and related tooling will need updates as the ecosystem moves toward the new format. The move aligns Let’s Encrypt with broader work by **Google, Cloudflare, Chrome, DigiCert, and the IETF**, as browser and infrastructure vendors push for scalable post-quantum TLS ahead of government migration deadlines from the NSA, NIST, and the EU. Let’s Encrypt plans a staging environment for MTC issuance in late 2026 and a production-ready deployment in 2027, while continuing to track `ML-DSA` support for traditional X.509 use cases outside the browser ecosystem. It also said the more urgent near-term defense remains post-quantum encryption against harvest-now-decrypt-later threats, urging operators to enable hybrid key exchange such as: ```text X25519MLKEM768 ```
Jun 29, 2026
Cloudflare has added post-quantum authentication to **Authenticated Origin Pulls** and **Custom Origin Trust Store**, enabling customers to use **ML-DSA** signatures for Cloudflare-to-origin TLS and build fully post-quantum-secure mutual TLS on that link. The company said the protection is effective only if organizations also remove trust in classical authentication paths to avoid downgrade attacks, and positioned the release as a key step toward its stated goal of full post-quantum security by 2029. Cloudflare also noted that post-quantum authentication for browser-facing WebPKI traffic will follow a different approach based on **Merkle Tree Certificates**. The rollout comes amid broader industry acceleration toward quantum-safe security. Cloudflare Radar has been tracking worldwide post-quantum encryption adoption, while Microsoft said the timeline for quantum risk is shifting and urged faster migration planning. Cloudflare said the new capability required changes across its Go-based control plane and **Pingora Origin** data plane, and disclosed that a **BoringSSL** upgrade triggered a June 10, 2026 incident when stricter `KeyUsage` enforcement caused compatibility problems before the issue was patched and resolved.
Jul 29, 2026