Cloudflare Builds Internet's New Trust Layer

The Future of Web Trust

Cloudflare's announcement to become a public Certificate Authority (CA) is a monumental step, aiming to democratize trust and enhance the security of the internet. The dual-pronged approach of acquiring an established root and building a new one for future needs, particularly post-quantum cryptography, is strategically sound. This move addresses systemic risks associated with a single dominant free CA like Let's Encrypt, providing much-needed redundancy. Their commitment to ACME-first issuance, transparency, and 'fail small' principles demonstrates a deep understanding of operational resilience, learned from years of managing TLS at immense scale.

However, the path to becoming a widely trusted CA is arduous and fraught with challenges. The process of gaining inclusion in root programs is rigorous and can be lengthy. While acquiring GlobalSign's root provides immediate broad reach, the long-term success and trust in Cloudflare's own new root will depend on its acceptance and propagation across diverse ecosystems. Furthermore, operating a CA is a highly sensitive and responsible undertaking; any security incident or operational failure could have widespread repercussions, potentially undermining the very trust they aim to build. The transition to post-quantum certificates, while forward-thinking, also presents its own set of complexities and adoption hurdles for the broader internet ecosystem.

Key Points

• Cloudflare is announcing its intent to become a public Certificate Authority (CA).
• They are acquiring an established root from GlobalSign for immediate broad trust and building a new root for future ecosystem needs.
• Cloudflare plans to be a leader in post-quantum certificates, aiming for Merkle Tree Certificates (MTCs) by early 2027.
• The CA will be ACME-first, promoting automated issuance and renewal.
• Key principles include transparency, reproducible builds, attested hardware, and a public issuance health dashboard.
• The move aims to provide redundancy for the internet's trust infrastructure, similar to how Universal SSL provided redundancy for encrypted sites.

---

📖 Source: Building a certificate authority for the whole Internet