Cloudflare develops certificate authority for the post-quantum web

What Cloudflare tested

Between early 2026 and August 2026, Cloudflare ran an experiment with Chrome Beta 146 using a new certificate format called Merkle Tree Certificate (MTC). According to InfoQ's report, the test served billions of MTCs to 50% of Chrome Beta users on selected domains on Cloudflare's free plan, and measured a 9% median performance gain compared to traditional certificates.

Cloudflare attributes most of this gain to a specific technical detail: the elimination of intermediate certificates from the TLS handshake. It's important to note that the experiment used classical cryptographic signatures, not post-quantum ones, which separates the measured performance gain from the scaling problem the technology aims to solve in the long run.

With the experiment concluded, the company is developing a public certificate authority (CA) capable of issuing MTCs, with a goal of entering Chrome's post-quantum Root Store in early 2027, subject to Google's evaluation. There is, therefore, no confirmed general availability date: what exists is a roadmap declared by Cloudflare.

The problem driving the change

Post-quantum signatures, designed to withstand attacks from quantum computers, are about 40 times larger than classical cryptographic signatures, according to Cloudflare. Multiplied across the full certificate chain that a traditional TLS handshake transmits, this significantly increases bandwidth and storage consumption across the entire Web PKI (the web's public key infrastructure).

For any service that performs TLS handshakes at scale (CDN, API gateway, load balancer), this increase isn't cosmetic: it affects connection latency, traffic cost, and even the viability of resource-constrained devices. It's this scaling bottleneck that the MTC format tries to solve before the migration to post-quantum cryptography becomes mandatory.

How the Merkle Tree Certificate works

Instead of signing certificates individually, as happens today, a CA that issues MTCs records each certificate's data in a Merkle tree (an append-only data structure, meaning one that only allows adding records, never altering them) and signs a checkpoint of the entire tree. The client no longer receives a certificate signed in isolation: it receives a compact cryptographic proof of inclusion showing that the certificate is inside the signed tree.

Domain validation still uses the ACME protocol (Automated Certificate Management Environment), the same standard behind CAs like Let's Encrypt. The novelty lies in a second actor: an independent mirroring cosigner, which verifies and stores the tree's updated states. This cosigner helps detect inconsistent views of the log (when different parts of the system see divergent versions of the tree) and preserves the issuance history in case the original log becomes unavailable.

A lighter handshake with landmarks

The part that matters most to infrastructure operators is the landmark relative certificate mechanism. Cloudflare distributes authenticated landmarks to clients (reference points in the Merkle tree), and the client uses these landmarks to verify a certificate's inclusion without needing to download the full chain.

In the common case, the handshake transmits only a public key, a signature, and an inclusion proof under 1 KB, according to Cloudflare. The server still needs to prove possession of the private key, so the security of the trust model doesn't change, only the volume of data exchanged.

But this is the happy exception. Newly installed clients, offline clients, or ones without the latest landmark can't verify the compact proof. For these cases, the server needs to keep a standalone MTC certificate as a fallback, which means that anyone adopting the format needs infrastructure that supports both paths simultaneously, at least during the transition.

What Prince and the security community say

In a company statement, Cloudflare CEO Matthew Prince described the scale of the challenge:

Upgrading the web's security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet.

Matthew Prince, CEO of Cloudflare

Not everyone received the announcement without reservations. Alicja Tendaj, a Tier 2 technical support specialist at SSL.com, questioned on LinkedIn how revocation and incident response work in a Merkle tree-based model:

With short validity and trust anchored in a tree head, a lot of the old OCSP and CRL playbook becomes a question of how quickly you can stop including a certificate.

Alicja Tendaj, Tier 2 Technical Support Specialist at SSL.com

Cloudflare itself acknowledges that three prerequisites are still missing for wider adoption: independent monitoring at production volume, a diverse ecosystem of CAs and cosigners (currently concentrated in Cloudflare itself), and browser support beyond Chrome.

What changes for developers in Brazil

For teams operating behind a CDN or managing their own TLS certificates, the immediate practical takeaway isn't the 9% gain measured in the experiment, already attributed mostly to the removal of intermediate certificates rather than to the MTC format itself. The point is different: the migration to post-quantum cryptography is coming, signatures 40 times larger will weigh on the handshake of any application, and the certification infrastructure is being redesigned now to absorb that weight.

Anyone maintaining services with high volumes of TLS connections (fintechs, digital banks, e-commerces, public APIs) should follow this transition closely, because the model changes how revocation and trust work: short certificate validity instead of traditional revocation lists (CRL) or online checking (OCSP), as Tendaj's critique points out. This has a direct implication for how Brazilian security teams will need to react to a compromised certificate when (and if) the MTC model becomes standard.

For now, none of this calls for immediate action: there's no public CA in production, no confirmed support in browsers beyond Chrome, and the goal of entering the post-quantum Root Store, early 2027, depends on external evaluation. The message is one of monitoring, not migration: it's worth following Cloudflare's technical blog and Chrome's Root Store updates before making any changes to TLS pipelines.