The internet is on the cusp of its most significant cryptographic overhaul in decades. On September 30, 2026, Cloudflare dropped an announcement that should be on every enterprise security team's radar: it plans to become a public Certificate Authority (CA) issuing quantum-safe TLS certificates — and it intends to do it for free. For IT leaders still treating post-quantum cryptography (PQC) as a distant concern, this is your wake-up call.

What Cloudflare Just Announced — And Why It Matters

Cloudflare announced its intent to become a public Certificate Authority, offering an open service that issues the digital certificates websites need to encrypt traffic and prove their identity to visitors. The new CA will support both traditional encryption and next-generation post-quantum Merkle Tree Certificates (MTCs), giving every website a path to stay protected as computing power advances — with no new tools or rebuilds required.

This is a pivotal step for the broader web.

To help build the massive system and establish ubiquity across the sprawling TLS ecosystem, Cloudflare will be acquiring an already trusted certificate root from GlobalSign.

Critically for enterprise budgets,

the hybrid certificates will be free to both paying and non-paying users.

On the timeline front,

Cloudflare will begin issuing classical certificates following completion of browser root program application and acceptance, with production MTC issuance scheduled to begin in the first quarter of 2027.

The Problem With Today's TLS Infrastructure

To appreciate why Cloudflare's announcement is so significant, you need to understand what's broken about the current system.

The initiative amounts to a fundamental overhaul of WebPKI — the public key infrastructure underpinning the web. Today's system relies on a chain of quantum-vulnerable signatures to verify certificate authenticity. Cloudflare aims to secure that chain against future threats.

The technical challenge is enormous.

Quantum-proof X.509 certificates would otherwise add roughly 40 times the data to a TLS handshake.

At internet scale,

the additional computational cost and network bandwidth load required to implement such a system would cause traditional networks to collapse.

This is where Merkle Tree Certificates come in.

Co-authored by Cloudflare as an IETF draft specification, MTCs verify that a certificate is logged in a trusted registry using lightweight proofs, avoiding the need to transmit heavy post-quantum signatures with every connection.

The real-world results are promising:

in production trials conducted with Chrome Beta 146 across Cloudflare domains, landmark-relative MTCs demonstrated a 9% net performance speedup at the median over classical signature chains while maintaining cryptographic auditability.

The "Harvest Now, Decrypt Later" Threat Is Active Today

Many enterprise security leaders are waiting for quantum computers to arrive before acting on PQC. This is a dangerous miscalculation.

Harvest now, decrypt later (HNDL) is an attack strategy in which adversaries steal and store encrypted data today so they can decrypt it later, once quantum computers are powerful enough to break current encryption. In the Thales 2026 Quantum & AI Threat Report, 61% of respondents named HNDL their top quantum-related concern.

The quantum timeline is also compressing faster than expected.

Three papers published between May 2025 and March 2026 reduced the estimated quantum resources needed to break RSA-2048 from 20 million qubits to fewer than 1 million. A February 2026 study described a new fault-tolerant architecture factoring RSA-2048 with fewer than 100,000 physical qubits — an order of magnitude below previous estimates.

Cryptographic migrations take years to complete. Identifying where encryption is used, testing new algorithms, coordinating vendor support, and deploying replacements across complex infrastructure all require time. Organizations that wait until quantum computers are imminent will find themselves trying to secure data that adversaries have already collected.

Where Cloudflare Already Stands on Post-Quantum Security

While the new CA announcement is forward-looking, Cloudflare has already made significant progress on the key exchange half of the PQC equation.

In August 2024, NIST finalized its PQC standards: ML-KEM for key agreement, and ML-DSA and SLH-DSA for digital signatures.

Cloudflare moved quickly.

The company deployed a hybrid key agreement combining ML-KEM (post-quantum secure) and X25519 (classical) to secure TLS 1.3 traffic to its servers and internal systems. As of mid-September 2025, around 43% of human-generated connections to Cloudflare are already protected with this hybrid post-quantum secure key agreement.

Operating as its own "Customer Zero," Cloudflare will route its global edge network — terminating TLS for over 20% of global web traffic — through the new CA stack.

This self-deployment at scale is a powerful signal of confidence in the technology's production readiness.

It's important to understand the distinction between the two phases, though.

Deploying ML-KEM for key exchange provides HNDL protection immediately for data in transit. It does not provide quantum-resistant certificate authentication — that is a subsequent work stream.

Cloudflare's new CA initiative directly addresses that second phase.

What This Means Specifically for Enterprise Security Teams

For enterprises, Cloudflare's CA announcement and broader PQC push have several concrete implications:

1. The migration is no longer optional.

The post-quantum migration is not optional. NIST finalized the standards. The NSA set the deadlines. The "harvest now, decrypt later" threat is active today.

2. Compliance timelines are tightening.

The NSA's CNSA 2.0 already requires quantum-resistant algorithms for new national security systems acquisitions beginning January 1, 2027.

3. Hybrid approaches are the practical bridge.

Pure quantum-resistant deployments will remain rare in 2026. Instead, hybrid approaches combining classical and post-quantum algorithms will dominate enterprise implementations through the transition period.

4. Frictionless migration is now achievable.

Site owners will be able to manage both classic TLS certificates and next-generation Merkle Tree Certificates within a single, unified system, enabling a smooth transition to post-quantum security without forcing immediate cutovers.

Practical Tips: What Enterprise Security Teams Can Do Right Now

You don't have to wait for 2027's MTC rollout to start hardening your organisation. Here are concrete actions to take immediately:

The first step is knowing where you stand. Most enterprises underestimate how deeply encryption is rooted in their processes: customer databases, payment systems, APIs, cloud apps, employee devices, IoT sensors, and even printers.

The first practical step of PQC migration is already deployable in production. Hybrid key exchange — combining a classical elliptic-curve algorithm with the post-quantum ML-KEM — is shipping in current browsers and TLS libraries. It protects against the harvest-now-decrypt-later threat for session confidentiality without waiting for post-quantum certificates.

If legacy systems are still pinned to TLS 1.2, post-quantum key exchange won't help at all. Migrate to TLS 1.3 first — only TLS 1.3 sessions can use the hybrid ML-KEM groups.

Confirm the TLS library version supports the hybrid group natively before changing configuration; OpenSSL 3.5 or later is the practical baseline.

For any Cloudflare plan, hybrid post-quantum key exchange is enabled by default at the edge, at no additional cost — X25519MLKEM768 is the recommended default group and requires no extra configuration.

NIST officials advise organisations to start planning now to migrate to PQC to protect high-value, long-lived sensitive data.

If your data needs to remain confidential beyond 2030, it is already at risk under current encryption.

Organisations must adopt flexible architectures that enable seamless transitions between legacy and post-quantum algorithms as standards evolve.

Lock-in to any single algorithm today creates technical debt tomorrow.

The Broader WebPKI Overhaul: A Multi-Year Journey

It's worth setting realistic expectations.

The full makeover of WebPKI will take years to complete, because it requires the work of an untold number of engineers who design operating systems, browsers, certificate authorities, and internet infrastructure.

This isn't a single software update — it is a fundamental architectural re-engineering of how trust is established online.

Given that cryptographic transitions take 5 to 10 years to complete, and that adversaries are already collecting data, the window for orderly migration is narrowing. Organisations protecting data that must remain confidential into the 2030s or beyond cannot afford to wait for more precise timelines.

Cloudflare's move to become a public CA — bringing quantum-safe Merkle Tree Certificates to millions of websites with zero performance penalty and zero additional cost — dramatically lowers the barrier for that migration. But the infrastructure still needs your organisation to engage actively, not passively.

Conclusion: The Post-Quantum Era Has Already Begun

The quantum threat isn't a future problem. HNDL attacks are running now, quantum resource estimates are falling fast, and regulatory deadlines are locking in. Cloudflare's quantum-safe TLS certificate initiative is one of the most significant signals yet that the industry has moved from research to production.

For enterprise security teams, this is the moment to act: audit your cryptographic posture, enable hybrid ML-KEM key exchange on your TLS 1.3 infrastructure today, and prepare for the seamless migration that Cloudflare's new CA will facilitate from Q1 2027. The organisations that build quantum-safe foundations now won't just avoid compliance risk — they'll have a genuine competitive advantage as the post-quantum web becomes the standard.

Ready to assess your organisation's post-quantum readiness? Start with a full cryptographic inventory, engage your security vendors on their PQC roadmaps, and monitor Cloudflare's CA rollout closely. The window for orderly migration is open — but it won't stay open forever.